Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565724
MD5:	efd5937f50c21b5ce660d67f3f995821
SHA1:	28c4a690949e1a798904c67a869e33ec0f70ba13
SHA256:	5a09d23637929d77e9c04322d800690bc6e7272e0755843f387c37b99f452fb8
Tags:	exeuser-Bitsight
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to capture screen (.Net source)

Machine Learning detection for dropped file

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Stores large binary data to the registry

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 4464 cmdline: "C:\Users\user\Desktop\file.exe" MD5: EFD5937F50C21B5CE660D67F3F995821)

schtasks.exe (PID: 4900 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 1396 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 5324 cmdline: C:\Windows\system32\WerFault.exe -u -p 4464 -s 1548 MD5: FD27D9F6D02763BDE32511B5DF7FF7A0)

github.exe (PID: 5332 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

github.exe (PID: 3612 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

github.exe (PID: 6288 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

github.exe (PID: 4548 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

github.exe (PID: 6048 cmdline: C:\Users\user\AppData\Roaming\github.exe MD5: EFD5937F50C21B5CE660D67F3F995821)

schtasks.exe (PID: 4500 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

conhost.exe (PID: 2720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
file.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
file.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Roaming\github.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
C:\Users\user\AppData\Roaming\github.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a28:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ac5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bda:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x7864:$cnc4: POST / HTTP/1.1
0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: file.exe PID: 4464	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: github.exe PID: 6048	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.file.exe.1f0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.file.exe.1f0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0xb828:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0xb8c5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0xb9da:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0xb664:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 4464, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Roaming\github.exe, ParentImage: C:\Users\user\AppData\Roaming\github.exe, ParentProcessId: 6048, ParentProcessName: github.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", ProcessId: 4500, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\System32\schtasks.exe, NewProcessName: C:\Windows\System32\schtasks.exe, OriginalFileName: C:\Windows\System32\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 4464, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", ProcessId: 4900, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:50:12.564317+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:21.803302+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:23.014211+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:33.465699+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:43.918831+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:51.814724+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:54.432651+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:04.824542+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:09.654756+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:09.864173+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:10.454592+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:10.738647+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:15.060901+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:19.793422+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:21.812970+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.073709+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.200549+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.320839+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.527460+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.736397+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:26.067338+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:30.859539+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:31.070001+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:41.456528+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:41.666901+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:46.210378+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:47.435009+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.636877+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.850817+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:54.835154+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49822	TCP
2024-11-30T16:51:56.996773+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:57.207115+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:52:21.838590+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:52:32.711224+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:53:17.594430+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:21.847241+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:33.003664+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:46.931470+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:51.857063+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:54:01.603960+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:54:03.244083+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:50:12.643357+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:23.015820+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:33.468092+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:43.921384+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:54.434649+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:04.826643+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:09.662560+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:09.873575+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:10.456609+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:10.741862+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:15.063564+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:19.795772+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:25.606526+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:25.902700+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:26.185995+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:30.863516+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:31.071572+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:33.999086+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.122772+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.249174+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.370530+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.497285+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.624520+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.768811+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.892365+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.060270+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.185176+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.443452+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.563586+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.683837+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.795590+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.978074+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.098567+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.219877+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.344969+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.393729+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.513714+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.633903+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.754006+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.874148+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.962504+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.086777+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.208267+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.334509+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.464429+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.585171+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.626459+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.747918+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.957117+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.321395+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.441409+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.562931+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.688664+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.815602+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.177953+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.304771+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.430260+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.534450+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.910585+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.034305+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.154483+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.243128+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.382449+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.604633+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.835088+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.147414+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.273561+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.395553+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.460527+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.515632+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.636111+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.668482+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.761133+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.794146+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.881331+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.001428+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.126576+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.246928+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.459438+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.579948+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.700698+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.820724+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.940850+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.061075+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.206914+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.328303+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.448579+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.572661+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.693683+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.888243+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.010541+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.134515+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.255303+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.331991+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.452034+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.589044+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.709081+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.830251+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.950502+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.070585+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.286444+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.406517+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.530524+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.654666+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.776082+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.896245+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.198462+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.214458+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:46.319477+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.440258+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.561066+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.681137+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.898463+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.019175+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.139163+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.259201+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.379133+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.442462+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:47.602529+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.726321+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.846422+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.966450+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.034603+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.158550+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.299668+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.422516+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.543162+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.663722+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.784004+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.906496+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.041293+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.161507+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.282022+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.430464+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.694462+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.900716+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.080141+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.200432+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.320526+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.440778+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.560985+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.802832+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.922883+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.042943+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.163464+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.283428+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.403590+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.552115+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.638403+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:51.672816+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.799237+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.920598+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.042635+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.170469+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.508364+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.630146+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.839768+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.959862+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.107857+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.228054+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.348096+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.468395+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.588417+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.778822+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.899221+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.019388+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.140854+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.262283+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.456298+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.576467+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.696984+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.818226+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:56.999543+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:57.209270+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:53:17.613505+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:53:33.053965+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:53:46.933157+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:54:01.606203+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:54:03.244859+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	50015	179.43.171.209	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:50:21.803302+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:51.814724+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:21.812970+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.850817+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:52:21.838590+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:53:21.847241+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:51.857063+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	50015	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:51:33.999086+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.122772+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.249174+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.370530+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.497285+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.624520+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.768811+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.892365+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.060270+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.185176+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.443452+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.563586+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.683837+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.795590+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.978074+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.098567+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.219877+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.344969+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.393729+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.513714+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.633903+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.754006+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.874148+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.962504+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.086777+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.208267+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.334509+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.464429+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.585171+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.626459+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.747918+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.957117+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.321395+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.441409+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.562931+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.688664+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.815602+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.177953+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.304771+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.430260+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.534450+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.910585+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.034305+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.154483+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.243128+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.382449+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.604633+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.835088+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.147414+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.273561+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.395553+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.515632+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.636111+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.761133+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.881331+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.001428+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.126576+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.246928+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.459438+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.579948+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.700698+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.820724+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.940850+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.061075+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.206914+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.328303+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.448579+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.572661+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.693683+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.888243+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.010541+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.134515+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.255303+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.331991+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.452034+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.589044+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.709081+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.830251+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.950502+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.070585+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.286444+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.406517+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.530524+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.654666+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.776082+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.896245+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.198462+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.319477+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.440258+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.561066+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.681137+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.898463+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.019175+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.139163+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.259201+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.379133+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.602529+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.726321+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.846422+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.966450+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.034603+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.158550+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.299668+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.422516+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.543162+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.663722+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.784004+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.906496+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.041293+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.161507+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.282022+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.430464+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.694462+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.900716+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.080141+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.200432+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.320526+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.440778+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.560985+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.802832+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.922883+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.042943+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.163464+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.283428+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.403590+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.552115+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.672816+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.799237+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.920598+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.042635+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.170469+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.508364+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.630146+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.839768+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.959862+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.107857+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.228054+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.348096+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.468395+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.588417+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.778822+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.899221+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.019388+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.140854+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.262283+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.456298+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.576467+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.696984+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.818226+0100	2852873	1	Malware Command and Control Activity Detected	192.168.2.4	49822	179.43.171.209	7000	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:51:30.592125+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:51:33.505510+0100	2853191	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T16:51:32.936491+0100	2853192	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: file.exe

Malware Configuration Extractor: Xworm {"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Roaming\github.exe

ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 55%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\github.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: file.exe	String decryptor: 179.43.171.209
Source: file.exe	String decryptor: 7000
Source: file.exe	String decryptor: <123456789>
Source: file.exe	String decryptor: <Xwormmm>
Source: file.exe	String decryptor: XWorm V5.6
Source: file.exe	String decryptor: USB.exe
Source: file.exe	String decryptor: %AppData%
Source: file.exe	String decryptor: github.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbr) source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Users\user\Desktop\file.PDB source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.pdbh source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32edC^i18 source: file.exe, 00000000.00000002.3235318254.000000001B400000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: rsymbols\dll\mscorlib.pdbpdb` source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbPDB" source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: file.exe, 00000000.00000002.3235318254.000000001B4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb; source: file.exe, 00000000.00000002.3235318254.000000001B4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb, source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbSystem.Xml.dll` source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdbP source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr

Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00007FFD9B8BE3D2h	0_2_00007FFD9B8BE20D
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00007FFD9B8BF9B4h	0_2_00007FFD9B8BC8B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00007FFD9B8BF9C5h	0_2_00007FFD9B8BC8B0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00007FFD9B8C05F7h	0_2_00007FFD9B8BC8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 4x nop then jmp 00007FFD9B8C05F7h	0_2_00007FFD9B8BC8F0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 179.43.171.209:7000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 179.43.171.209:7000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852873 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2 : 192.168.2.4:49822 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49822 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2853192 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2853191 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound : 179.43.171.209:7000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 179.43.171.209:7000 -> 192.168.2.4:50015
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:50015 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 179.43.171.209:7000 -> 192.168.2.4:50015
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 179.43.171.209:7000 -> 192.168.2.4:49822

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 179.43.171.209

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 179.43.171.209:7000

Source: Joe Sandbox View

ASN Name: PLI-ASCH PLI-ASCH

Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209

Source: file.exe, 00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to capture screen (.Net source)

Source: 0.2.file.exe.1acb0000.0.raw.unpack, RemoteDesktop.cs

.Net Code: GetScreen

System Summary

Malicious sample detected (through community Yara rule)

Source: file.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.file.exe.1f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED	Matched rule: Detects AsyncRAT Author: ditekSHen

PE file contains section with special chars

Source: file.exe	Static PE information: section name: U@7'
Source: github.exe.0.dr	Static PE information: section name: U@7'

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8BD015	0_2_00007FFD9B8BD015
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B8C55	0_2_00007FFD9B8B8C55
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8BB2F9	0_2_00007FFD9B8BB2F9
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B7B1A	0_2_00007FFD9B8B7B1A
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B0F28	0_2_00007FFD9B8B0F28
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B11DA	0_2_00007FFD9B8B11DA
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8BC8F0	0_2_00007FFD9B8BC8F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B11C8	0_2_00007FFD9B8B11C8
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 3_2_00007FFD9B891BAE	3_2_00007FFD9B891BAE
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 3_2_00007FFD9B8910A0	3_2_00007FFD9B8910A0
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 3_2_00007FFD9B8910F2	3_2_00007FFD9B8910F2
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 3_2_00007FFD9B891118	3_2_00007FFD9B891118
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 4_2_00007FFD9B891BAE	4_2_00007FFD9B891BAE
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 4_2_00007FFD9B8910A0	4_2_00007FFD9B8910A0
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 4_2_00007FFD9B8910F2	4_2_00007FFD9B8910F2
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 4_2_00007FFD9B891118	4_2_00007FFD9B891118
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 8_2_00007FFD9B8A1BAE	8_2_00007FFD9B8A1BAE
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 8_2_00007FFD9B8A10A0	8_2_00007FFD9B8A10A0
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 8_2_00007FFD9B8A10F2	8_2_00007FFD9B8A10F2
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 8_2_00007FFD9B8A1118	8_2_00007FFD9B8A1118
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 13_2_00007FFD9B891BAE	13_2_00007FFD9B891BAE
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 13_2_00007FFD9B8910A0	13_2_00007FFD9B8910A0
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 13_2_00007FFD9B8910F2	13_2_00007FFD9B8910F2
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 13_2_00007FFD9B891118	13_2_00007FFD9B891118
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD0F28	15_2_00007FFD9BAD0F28
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD11C8	15_2_00007FFD9BAD11C8
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD2E68	15_2_00007FFD9BAD2E68

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4464 -s 1548

Source: file.exe, 00000000.00000000.1654542882.0000000000202000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegithub.exe4 vs file.exe
Source: file.exe, 00000000.00000002.3235116337.000000001ACB0000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameRemoteDesktop.dll< vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamegithub.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.file.exe.1f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe	Static PE information: Section: U@7' ZLIB complexity 1.0007672991071428
Source: github.exe.0.dr	Static PE information: Section: U@7' ZLIB complexity 1.0007672991071428

Source: 0.2.file.exe.1acb0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 0.2.file.exe.1acb0000.0.raw.unpack, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/8@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\github.exe

Jump to behavior

Source: C:\Users\user\AppData\Roaming\github.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Roaming\github.exe	Mutant created: \Sessions\1\BaseNamedObjects\aKo7AtdK4OEvATqs
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1396:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2720:120:WilError_03
Source: C:\Windows\System32\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4464

Source: C:\Windows\System32\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\91def029-68b7-4b1a-a002-40da87a1053b

Jump to behavior

Source: file.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 55%

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 4464 -s 1548
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\github.exe C:\Users\user\AppData\Roaming\github.exe
Source: C:\Users\user\AppData\Roaming\github.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Source: C:\Windows\System32\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: xmllite.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5F29CE-E0A8-49D3-AF32-7A7BDC173478}\InProcServer32

Jump to behavior

Source: github.lnk.0.dr

LNK file: ..\..\..\..\..\github.exe

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: file.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: Microsoft.VisualBasic.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Xml.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbr) source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Users\user\Desktop\file.PDB source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.pdbh source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS7^3l source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.ni.pdbRSDS& source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.pdbCLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\Servererver32edC^i18 source: file.exe, 00000000.00000002.3235318254.000000001B400000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: 0C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: rsymbols\dll\mscorlib.pdbpdb` source: file.exe, 00000000.00000002.3235867035.000000001B739000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdbPDB" source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbD source: file.exe, 00000000.00000002.3235318254.000000001B4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Windows.Forms.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb; source: file.exe, 00000000.00000002.3235318254.000000001B4E0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Management.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Drawing.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: mscorlib.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Management.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: \??\C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Core.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb, source: file.exe, 00000000.00000002.3235318254.000000001B477000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdbSystem.Xml.dll` source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Configuration.pdbP source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.ni.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WER9F9F.tmp.dmp.12.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WER9F9F.tmp.dmp.12.dr

Source: initial sample

Static PE information: section where entry point is pointing to: XejnR

Source: file.exe	Static PE information: section name: U@7'
Source: file.exe	Static PE information: section name: XejnR
Source: github.exe.0.dr	Static PE information: section name: U@7'
Source: github.exe.0.dr	Static PE information: section name: XejnR

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00007FFD9B8B00BD pushad ; iretd	0_2_00007FFD9B8B00C1
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD3B05 pushad ; retf	15_2_00007FFD9BAD3B3D
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD2A5D push E95E5007h; ret	15_2_00007FFD9BAD2AF9
Source: C:\Users\user\AppData\Roaming\github.exe	Code function: 15_2_00007FFD9BAD7EDA push eax; ret	15_2_00007FFD9BAD7EE9

Source: file.exe	Static PE information: section name: U@7' entropy: 7.9871822316254475
Source: github.exe.0.dr	Static PE information: section name: U@7' entropy: 7.9871822316254475

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\github.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\AAF0BA07CDEB53E61426 88D9A666AFE4B49FD15B45F1DC568347855CF049E54918D00BAF1610AE750872

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\github.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 22F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 1A4A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1050000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1A8B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: FF0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1AB70000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 2A50000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1ABE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: C30000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1A8F0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 9A0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Memory allocated: 1A570000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 7380	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 2440	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Window / User API: threadDelayed 7301	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Window / User API: threadDelayed 2547	Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 2132	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 1344	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 1396	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 4248	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 4908	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 3668	Thread sleep count: 38 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 3668	Thread sleep time: -35048813740048126s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 5496	Thread sleep count: 7301 > 30	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe TID: 5496	Thread sleep count: 2547 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: github.exe, 0000000F.00000002.4135597921.000000001B446000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW=b%SystemRoot%\system32\mswsock.dllconnectionStringName="LocalSqlServer"
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.3235318254.000000001B400000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen%SystemRoot%\system32\mswsock.dllroviders>
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process token adjusted: Debug	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"			Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Process created: C:\Windows\System32\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"			Jump to behavior

Source: file.exe, 00000000.00000002.3233150482.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.000000000261C000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.00000000025C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.3233150482.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.000000000261C000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.00000000025C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.3233150482.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.000000000261C000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.00000000025C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.3233150482.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2y
Source: file.exe, 00000000.00000002.3233150482.0000000002A2A000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.000000000261C000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.00000000025C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: 'PING!<Xwormmm>Program Manager<Xwormmm>0@
Source: github.exe, 0000000F.00000002.4134757107.000000000261C000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.00000000025C9000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager2

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Users\user\Desktop\file.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\github.exe	Queries volume information: C:\Users\user\AppData\Roaming\github.exe VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: github.exe, 0000000F.00000002.4135597921.000000001B480000.00000004.00000020.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4133786462.00000000006BC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\file.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct
Source: C:\Users\user\AppData\Roaming\github.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: github.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: file.exe, type: SAMPLE
Source: Yara match	File source: 0.0.file.exe.1f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 4464, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: github.exe PID: 6048, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\github.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	231 Security Software Discovery	Remote Services	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Modify Registry	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	1 Disable or Modify Tools	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	141 Virtualization/Sandbox Evasion	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Deobfuscate/Decode Files or Information	Cached Domain Credentials	13 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	3 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	2 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
file.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Roaming\github.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\github.exe	55%	ReversingLabs	ByteCode-MSIL.Trojan.XWorm

Source	Detection	Scanner	Label	Link
179.43.171.209	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
179.43.171.209	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.12.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, github.exe, 0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
179.43.171.209	unknown	Panama		51852	PLI-ASCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565724
Start date and time:	2024-11-30 16:49:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 3s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/8@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 94% Number of executed functions: 21 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
10:49:54	API Interceptor	4170595x Sleep call for process: file.exe modified
10:49:56	API Interceptor	168x Sleep call for process: github.exe modified
10:52:31	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:49:56	Task Scheduler	Run new task: github path: C:\Users\user\AppData\Roaming\github.exe
15:49:58	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLI-ASCH	H4IoDDh3Rv.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	176.223.112.134
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	179.43.171.197
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	179.43.182.252
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	81.17.20.50
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	190.211.254.101
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	190.211.254.192
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	81.17.25.195
	SCV.cmd	Get hash	malicious	Unknown	Browse	179.43.180.122

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_489542ce3eb4b4cc3c3bd7df7e4d98eb5ea1839_8bc8969b_736690da-bad7-4558-90ec-2c5b112d0ce3\Report.wer

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.3900530712829182
Encrypted:	false
SSDEEP:	192:oiBvjv4yOY081iHYIxaWz8iyX8CNln72ZFxZzuiFAZ24lO8HVB:/b4J81iZa48i/SuZzuiFAY4lO87
MD5:	233811CAB1431FC51B33AEA1CA117B5F
SHA1:	0E872E5DAA110425CC538BD85D584DD330CD4E6B
SHA-256:	A8ABFE1EE640A732D8EFBFED32A9F727C49A6FD876996EC0CEB57D52BBB07596
SHA-512:	385964B78A6C14D9E4ADF21ECA1B4BE64AE54637A9D5D7C8854029A5365A7D9A0E16ACC48F58C9E35731252F13B348E66E7F36343D12E3B6EF12CFE8F391940D
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.4.5.5.5.1.9.4.8.0.9.3.4.1.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.4.5.5.5.2.0.7.3.0.9.2.7.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.3.6.6.9.0.d.a.-.b.a.d.7.-.4.5.5.8.-.9.0.e.c.-.2.c.5.b.1.1.2.d.0.c.e.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.5.6.b.d.f.1.5.2.-.b.9.4.8.-.4.0.8.1.-.8.e.2.e.-.f.c.4.5.f.f.f.f.a.e.d.8.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.g.i.t.h.u.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.1.7.0.-.0.0.0.1.-.0.0.1.4.-.7.d.5.5.-.6.d.7.f.3.f.4.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.b.1.f.5.e.c.8.4.6.3.4.e.a.0.3.a.7.9.a.6.5.e.9.8.c.e.4.7.d.0.a.0.0.0.0.0.0.0.0.!.0.0.0.0.2.8.c.4.a.6.9.0.9.4.9.e.1.a.7.9.8.9.0.4.c.6.7.a.8.6.9.e.3.3.e.c.0.f.7.0.b.a.1.3.!.f.i.l.e...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F9F.tmp.dmp

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	Mini DuMP crash report, 16 streams, Sat Nov 30 15:51:59 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	642462
Entropy (8bit):	2.930222490285549
Encrypted:	false
SSDEEP:	3072:Yd2M60ASwsFFyMB3uPEBE47vzAtPMXcSnl61CCqv14uxXaRo3+vAtdN9tdN9tdNE:Ydo039aEK4vck7uqvGuVUo3Qtt
MD5:	08BB38236391942E7EC1396227F6F1C0
SHA1:	B0EEF06592139923F2704FF09E98A99AA07130E1
SHA-256:	BFBC15D815A3A4ACE6EF38471D58ECE5FBBAA9D85F8DE9D5D41333002E28152E
SHA-512:	C2192EE81D66A3F41F3192C49C93A002136F2E14ECF330A70A667243249E953EB8678D5636E67F4F02BDBAED6C0CAEA70A13F76AD83E50B3E9879E12BDF5FDA9
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........4Kg............T...........@'..t.......$....2...........2.......H..............l.......8...........T............X...t...........F...........H..............................................................................eJ......dI......Lw......................T.......p...!4Kg....(........................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...........................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA155.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	9158
Entropy (8bit):	3.7039269132747146
Encrypted:	false
SSDEEP:	192:R6l7wVeJuC/ks6Y9BvSj3agmfZDE87prnx89bHxvmPHTfVlhm:R6lXJ1X6YLvSj3agmfaJHx+PHTf/c
MD5:	3F73725B32BD5662435C081E2A4D23DE
SHA1:	F8E151384E3EB3D4C51B93AFF68A9986A58F2695
SHA-256:	AA5D985F855469B8D86BC6EB5D22763772D8EFB156735F634A4457C0543707B3
SHA-512:	275E6E522B49084F5E2A2FF7201ED3A3259BE60ECC35542DD503A3A4B2D619B3E1478EAF54162EA1C5526395B042C3D63AD94F0F9A488ADF8C6AF07E8AC1A839
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.4.4.6.4.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA175.tmp.xml

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4748
Entropy (8bit):	4.432176957408072
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZZJg771I9KFWpW8VYcPYm8M4JR6EFaXyq8vN6+yGbgDLid:uIjfJI7p07VlSJ4fWE+lqLid
MD5:	E9E8897322A91CBC377824766892BC38
SHA1:	A77A9EBD7C44F1E7ACFAF107A7285F37A572260E
SHA-256:	B08C4D11CCE894E51B7228B3B522ABAA30BE753A46CF1645B374FA1EB7252D83
SHA-512:	5BC3C0BE582AA3FFF3FE58F6A877E2B7158BF87AED50BAE224C6462846DFAE6611A241B07FEB6819B6CADC925FE9F28BB52DBEA31A02ACEB12AF84C5C535E193
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="610974" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\github.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\github.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	654
Entropy (8bit):	5.380476433908377
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khap+92n4MNQp3/VXM5gXu9tv:ML9E4KQwKDE4KGKZI6Kh6+84xp3/VclT
MD5:	30E4BDFC34907D0E4D11152CAEBE27FA
SHA1:	825402D6B151041BA01C5117387228EC9B7168BF
SHA-256:	A7B8F7FFB4822570DB1423D61ED74D7F4B538CE73521CC8745BC6B131C18BE63
SHA-512:	89FBCBCDB0BE5AD7A95685CF9AA4330D5B0250440E67DC40C6642260E024F52A402E9381F534A9824D2541B98B02094178A15BF2320148432EDB0D09B5F972BA
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\04de61553901f06e2f763b6f03a6f65a\Microsoft.VisualBasic.ni.dll",0..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Archive, ctime=Sat Nov 30 14:49:55 2024, mtime=Sat Nov 30 14:49:55 2024, atime=Sat Nov 30 14:49:55 2024, length=52736, window=hide
Category:	dropped
Size (bytes):	759
Entropy (8bit):	5.02726270492719
Encrypted:	false
SSDEEP:	12:8cBmBwg4RHWC2dY//6D2LMq0KmXEAtjAfrH8oKeEACOLBmV:8+sl+iDgDmXLJAfVL7LBm
MD5:	C431B80472A21549266CAF0AB39A2186
SHA1:	F94A2D58E26B18C04AFDF5070F3F05349A5E28FE
SHA-256:	F931F4FD7DB98571D11ADF16E2B1458B8DC3E0CB528886F33D63A6CE8D984930
SHA-512:	BA9D7A761F93C6820AAB4867D05988CE93E75CBA79A44C97FF9E23E47633E95A8981A539B1BA65E2441060F548F6FE78FA60228418BA6F0615A3C28E8950567B
Malicious:	false
Preview:	L..................F.... .....S.?C....S.?C....S.?C..........................t.:..DG..Yr?.D..U..k0.&...&......vk.v......y{?C..s..?C......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^~Y:~...........................%..A.p.p.D.a.t.a...B.V.1.....~Y8~..Roaming.@......CW.^~Y8~...........................\..R.o.a.m.i.n.g.....`.2.....~Y<~ .github.exe..F......~Y<~~Y<~..........................g.q.g.i.t.h.u.b...e.x.e.......X...............-.......W............u.Q.....C:\Users\user\AppData\Roaming\github.exe........\.....\.....\.....\.....\.g.i.t.h.u.b...e.x.e.`.......X.......942247...........hT..CrF.f4... ..T..b...,.......hT..CrF.f4... ..T..b...,......E.......9...1SPS..mD..pH.H@..=x.....h....H.....K...YM...?................

C:\Users\user\AppData\Roaming\github.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	6.560412971442069
Encrypted:	false
SSDEEP:	1536:J/mQgB/wjBHgXOo6PF09a3Yu2u29Pp9/D9gSFovbnlgZFO/86c9p:J/mzBIlAe3WuMzr9vFovbnmFO/54
MD5:	EFD5937F50C21B5CE660D67F3F995821
SHA1:	28C4A690949E1A798904C67A869E33EC0F70BA13
SHA-256:	5A09D23637929D77E9C04322D800690BC6E7272E0755843F387C37B99F452FB8
SHA-512:	13E092E75FD3FCF2DAFCE1E186F6583DF1F562FFEBC5F45CDF80A21F2DEA25DC96E1535194E393B94153E2D41CB8B0E86B7835CB918FB278E119486836BC1CD9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\github.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\github.exe, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.....................@.......`...`... ....@.. .......................`............@.................................T...W.... .......................@.......................................................`..................H...........U@...7'.@6... ...8..................@...XejnR........`.......<.............. ..`.text...............>.............. ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\System32\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465474120418933
Encrypted:	false
SSDEEP:	6144:GIXfpi67eLPU9skLmb0b4RWSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSba:rXD94RWlLZMM6YFH1+a
MD5:	E425F9AAB62D27392103565EADBFB511
SHA1:	ACD8A711831C936F8C8C4B41C532AEE8E703F0D2
SHA-256:	F968D7B97FDF7D2A9B1145292E22588400ED64FF06C4EDD169B99C4C1845E88C
SHA-512:	AF3215247FBE65C2E335A22A2B248800E838E8E31ABFBF4E5ED4E9E2017CBB86D8CEE2336D2D77B53D05F4E2B50D4C370576777BA13655416A9B2C57C4C2D9C6
Malicious:	false
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm.1K.?C..............................................................................................................................................................................................................................................................................................................................................+.\.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.560412971442069
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.96% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01%
File name:	file.exe
File size:	52'736 bytes
MD5:	efd5937f50c21b5ce660d67f3f995821
SHA1:	28c4a690949e1a798904c67a869e33ec0f70ba13
SHA256:	5a09d23637929d77e9c04322d800690bc6e7272e0755843f387c37b99f452fb8
SHA512:	13e092e75fd3fcf2dafce1e186f6583df1f562ffebc5f45cdf80a21f2dea25dc96e1535194e393b94153e2d41cb8b0e86b7835cb918fb278e119486836bc1cd9
SSDEEP:	1536:J/mQgB/wjBHgXOo6PF09a3Yu2u29Pp9/D9gSFovbnlgZFO/86c9p:J/mzBIlAe3WuMzr9vFovbnmFO/54
TLSH:	EA338E2C739083A5D6E83B3598F662330B3ABAD75E738F4D5794820B1D53394BD0639A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.....................@.......`...`... ....@.. .......................`............@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40600a
Entrypoint Section:	XejnR
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x674B3072 [Sat Nov 30 15:34:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00406000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x9454	0x57	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x12000	0x4ce	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x14000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x6000	0x8	XejnR
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x8000	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
U@7'	0x2000	0x3640	0x3800	24fe46f061557bcc63cb7b5ea49571bf	False	1.0007672991071428	data	7.9871822316254475	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
XejnR	0x6000	0x10	0x200	1e1e8b60a387632920fef4df72800438	False	0.04296875	data	0.12227588125913882	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.text	0x8000	0x87f4	0x8800	7556788c4657fd71bc6193fc9504e89f	False	0.5373965992647058	data	5.769865084802064	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0x12000	0x4ce	0x600	d411d24a8585785d52d5c0a3f715d899	False	0.373046875	data	3.7126756714690634	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x14000	0xc	0x200	56fe95061a1756a1322efd56a668547b	False	0.041015625	data	0.07763316234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x120a0	0x244	data			0.4706896551724138
RT_MANIFEST	0x122e4	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T16:50:12.133555+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:12.564317+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:12.643357+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:21.803302+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:21.803302+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:23.014211+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:23.015820+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:33.465699+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:33.468092+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:43.918831+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:43.921384+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:50:51.814724+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:51.814724+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:54.432651+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:50:54.434649+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:04.824542+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:04.826643+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:09.654756+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:09.662560+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:09.864173+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:09.873575+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:10.454592+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:10.456609+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:10.738647+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:10.741862+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:15.060901+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:15.063564+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:19.793422+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:19.795772+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:21.812970+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:21.812970+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.073709+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.200549+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.320839+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.527460+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.606526+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:25.736397+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:25.902700+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:26.067338+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:26.185995+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:30.592125+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:30.859539+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:30.863516+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:31.070001+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:31.071572+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:32.936491+0100	2853192	ETPRO MALWARE Win32/XWorm V3 CnC Command - sendPlugin Outbound	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:33.505510+0100	2853191	ETPRO MALWARE Win32/XWorm V3 CnC Command - savePlugin Inbound	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:33.999086+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:33.999086+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.122772+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.122772+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.249174+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.249174+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.370530+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.370530+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.497285+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.497285+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.624520+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.624520+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.768811+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.768811+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.892365+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:34.892365+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.060270+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.060270+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.185176+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.185176+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.443452+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.443452+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.563586+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.563586+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.683837+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.683837+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.795590+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.795590+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.978074+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:35.978074+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.098567+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.098567+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.219877+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.219877+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.344969+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.344969+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.393729+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.393729+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.513714+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.513714+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.633903+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.633903+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.754006+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.754006+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.874148+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.874148+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.962504+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:36.962504+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.086777+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.086777+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.208267+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.208267+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.334509+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.334509+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.464429+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.464429+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.585171+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.585171+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.626459+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.626459+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.747918+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.747918+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.957117+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:37.957117+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.321395+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.321395+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.441409+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.441409+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.562931+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.562931+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.688664+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.688664+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.815602+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:38.815602+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.177953+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.177953+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.304771+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.304771+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.430260+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.430260+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.534450+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.534450+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.910585+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:39.910585+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.034305+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.034305+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.154483+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.154483+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.243128+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.243128+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.382449+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.382449+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.604633+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.604633+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.835088+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:40.835088+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.147414+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.147414+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.273561+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.273561+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.395553+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.395553+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.456528+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:41.460527+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.515632+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.515632+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.636111+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.636111+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.666901+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:41.668482+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.761133+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.761133+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.794146+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:41.881331+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:41.881331+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.001428+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.001428+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.126576+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.126576+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.246928+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.246928+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.459438+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.459438+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.579948+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.579948+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.700698+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.700698+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.820724+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.820724+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.940850+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:42.940850+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.061075+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.061075+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.206914+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.206914+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.328303+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.328303+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.448579+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.448579+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.572661+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.572661+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.693683+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.693683+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.888243+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:43.888243+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.010541+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.010541+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.134515+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.134515+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.255303+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.255303+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.331991+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.331991+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.452034+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.452034+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.589044+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.589044+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.709081+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.709081+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.830251+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.830251+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.950502+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:44.950502+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.070585+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.070585+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.286444+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.286444+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.406517+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.406517+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.530524+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.530524+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.654666+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.654666+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.776082+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.776082+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.896245+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:45.896245+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.198462+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.198462+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.210378+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:46.214458+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:46.319477+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.319477+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.440258+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.440258+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.561066+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.561066+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.681137+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.681137+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.898463+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:46.898463+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.019175+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.019175+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.139163+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.139163+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.259201+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.259201+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.379133+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.379133+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.435009+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:47.442462+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:47.602529+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.602529+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.726321+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.726321+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.846422+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.846422+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.966450+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:47.966450+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.034603+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.034603+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.158550+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.158550+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.299668+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.299668+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.422516+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.422516+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.543162+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.543162+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.663722+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.663722+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.784004+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.784004+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.906496+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:48.906496+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.041293+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.041293+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.161507+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.161507+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.282022+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.282022+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.430464+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.430464+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.694462+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.694462+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.900716+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:49.900716+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.080141+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.080141+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.200432+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.200432+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.320526+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.320526+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.440778+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.440778+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.560985+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.560985+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.802832+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.802832+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.922883+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:50.922883+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.042943+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.042943+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.163464+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.163464+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.283428+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.283428+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.403590+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.403590+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.552115+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.552115+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.636877+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.638403+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:51.672816+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.672816+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.799237+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.799237+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.850817+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.850817+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:51.920598+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:51.920598+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.042635+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.042635+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.170469+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.170469+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.508364+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.508364+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.630146+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.630146+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.839768+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.839768+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.959862+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:52.959862+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.107857+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.107857+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.228054+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.228054+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.348096+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.348096+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.468395+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.468395+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.588417+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.588417+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.778822+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.778822+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.899221+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:53.899221+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.019388+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.019388+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.140854+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.140854+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.262283+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.262283+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.456298+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.456298+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.576467+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.576467+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.696984+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.696984+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.818226+0100	2852873	ETPRO MALWARE Win32/XWorm CnC PING Command Outbound M2	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.818226+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49822	179.43.171.209	7000	TCP
2024-11-30T16:51:54.835154+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49822	TCP
2024-11-30T16:51:56.996773+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:56.999543+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:51:57.207115+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:51:57.209270+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T16:52:21.838590+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:52:21.838590+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:52:32.711224+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T16:53:17.594430+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:17.613505+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:53:21.847241+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:21.847241+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:33.003664+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:33.053965+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:53:46.931470+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:46.933157+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:53:51.857063+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:53:51.857063+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:54:01.603960+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:54:01.606203+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	50015	179.43.171.209	7000	TCP
2024-11-30T16:54:03.244083+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	50015	TCP
2024-11-30T16:54:03.244859+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	50015	179.43.171.209	7000	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 16:50:01.280052900 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:01.400099039 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:01.400180101 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:01.682056904 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:01.802130938 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:12.133554935 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:12.253583908 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:12.564316988 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:12.611788988 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:12.643357038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:12.763468981 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:21.803302050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:21.846168041 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:22.581401110 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:22.703443050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:23.014210939 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:23.015820026 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:23.135987997 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:33.034142971 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:33.154879093 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:33.465698957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:33.468091965 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:33.587980032 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:43.487947941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:43.608536959 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:43.918831110 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:43.921384096 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:44.041434050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:51.814723969 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:51.861851931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:53.940260887 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:54.061111927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:54.432651043 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:50:54.434648991 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:50:54.554580927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:04.393476009 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:04.513453960 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:04.824542046 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:04.826642990 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:04.946604013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.221585989 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:09.342710018 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.342765093 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:09.462738991 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.654756069 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.662559986 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:09.784044027 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.864172935 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.873574972 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:09.993577003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:09.993709087 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.029622078 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.084438086 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.159301043 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.159780979 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.283030033 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.299587965 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.422911882 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.454591990 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.456609011 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.623243093 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.738646984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:10.741862059 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:10.862967014 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:14.628017902 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:14.749706030 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:15.060900927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:15.063564062 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:15.185477972 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:19.362354040 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:19.482431889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:19.793421984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:19.795772076 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:19.915739059 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:21.812969923 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:21.861897945 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:24.628106117 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:24.748174906 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:24.748219967 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:24.870014906 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:24.870064974 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:24.990076065 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:24.990124941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.073709011 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.073769093 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.110336065 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.110384941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.193862915 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.193923950 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.200548887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.252533913 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.287471056 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.287528038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.314271927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.320838928 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.361907959 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.441030979 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.441273928 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.527460098 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.527595043 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.603379965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.606525898 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.647975922 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.651282072 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.706423998 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.736397028 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.736604929 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:25.901729107 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:25.902699947 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:26.063349009 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:26.063473940 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:26.067337990 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:26.114423990 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:26.185471058 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:26.185995102 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:26.307019949 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:30.424870968 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:30.592077017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:30.592124939 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:30.714508057 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:30.859539032 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:30.863516092 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:30.986489058 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:31.070000887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:31.071572065 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:31.195219994 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:32.932578087 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:32.936491013 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.057879925 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.505510092 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.505587101 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.507221937 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.509773016 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.510077000 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.510142088 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.518239975 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.518361092 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.520591021 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.526582003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.526681900 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.526967049 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.535011053 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.535075903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.535223961 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.543363094 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.596545935 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.736560106 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.857671022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.857919931 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.877460003 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:33.998980045 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:33.999085903 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.122394085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.122771978 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.249007940 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.249174118 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.370102882 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.370529890 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.497217894 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.497284889 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.622158051 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.624520063 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.744421959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.768810987 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:34.890717030 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:34.892364979 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.013097048 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.060270071 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.185095072 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.185175896 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.220639944 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.268290997 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.323266983 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.355336905 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443353891 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443424940 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443451881 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.443491936 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443501949 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443677902 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.443686008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.563520908 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.563585997 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.683705091 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.683836937 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.795360088 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.795589924 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.803982973 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.856471062 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.916018009 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978002071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978037119 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978074074 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:35.978234053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978390932 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978602886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:35.978884935 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.098438025 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.098567009 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.219702005 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.219877005 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.344882965 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.344969034 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.393651962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.393728971 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.435051918 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.464927912 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.513659954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.513714075 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.555603027 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.555706978 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.555829048 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.555919886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.555990934 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.556031942 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.633835077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.633903027 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.753902912 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.754005909 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.874100924 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.874147892 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.962445974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:36.962503910 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:36.994384050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.037744045 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.086611986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.086776972 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.159179926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.159372091 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.159389973 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.208214998 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.208266973 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.331645966 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.334508896 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.460540056 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.464428902 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.584595919 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.585170984 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.620740891 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.626458883 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.746378899 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.747917891 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.928282022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:37.957117081 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:37.997574091 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.078905106 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.117868900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.117958069 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.117985010 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.118309021 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.131684065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.131704092 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.154722929 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.154747009 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.154756069 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.161066055 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.161079884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.161091089 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.174186945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.199069023 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.199084044 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.220670938 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.220680952 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.222790956 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.222886086 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.237868071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.237880945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.237891912 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.237931967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.237978935 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238018990 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238071918 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238107920 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238225937 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238261938 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238338947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238348007 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.238449097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.251913071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.251924992 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.251935959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.251954079 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.251993895 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.274694920 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.274749041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.274764061 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.281024933 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.281035900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.281392097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.294210911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.319118977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.321394920 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.441334009 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.441409111 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.562885046 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.562931061 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.688616037 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.688663960 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.752477884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.815553904 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:38.815602064 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.930002928 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.930075884 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:38.936449051 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050225019 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050259113 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050376892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050386906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050491095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050501108 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050545931 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050606012 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050721884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050730944 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050829887 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050837994 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050911903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.050920963 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051012039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051058054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051197052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051206112 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051282883 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051343918 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051429033 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051485062 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051521063 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051531076 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051604986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051656961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051686049 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051728010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051817894 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051826000 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.051856041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.056382895 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.056391954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.056442976 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.056524038 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177068949 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177079916 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177150011 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177220106 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177284002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177293062 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177333117 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177373886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177407980 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177459002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177510977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177520037 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177560091 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177647114 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177654982 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177700043 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177824020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177833080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.177953005 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.304708004 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.304770947 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.430016994 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.430259943 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.528460026 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.534450054 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.550973892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.656752110 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.656893969 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.656963110 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:39.780982018 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.780994892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781004906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781040907 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781172991 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781219959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781339884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781395912 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781465054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781533957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781701088 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781749010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.781956911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782016039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782198906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782207966 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782304049 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782320023 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782416105 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782424927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782510042 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782519102 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782610893 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782629013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782711983 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782721996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782854080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782864094 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.782988071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783036947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783222914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783273935 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783282042 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783416033 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783504963 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783668041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.783684969 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.852840900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.852972031 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.907998085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.908006907 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.908278942 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.908341885 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.908550978 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.908607960 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909018993 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909146070 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909390926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909408092 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909609079 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909686089 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909779072 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.909904957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:39.910584927 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.033090115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.034305096 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.154366016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.154483080 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.243014097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.243128061 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.276302099 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.363568068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.382448912 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.502660990 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.604633093 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.727266073 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:40.835088015 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.892829895 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.909502983 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:40.957588911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.018800020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.018810987 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.018841982 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.018851042 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.018888950 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019115925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019124985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019299984 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019308090 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019352913 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019439936 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019505978 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019556999 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019632101 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019639969 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019750118 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019759893 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019850016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019889116 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019982100 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.019990921 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020131111 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020143986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020231009 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020240068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020315886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020324945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020435095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020445108 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020519018 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020565987 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020605087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020613909 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020682096 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020700932 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020796061 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020804882 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020853996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020863056 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020901918 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020945072 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.020999908 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.021008968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.021043062 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.021132946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.021142006 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.084088087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.084099054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.098881960 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.098936081 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.145703077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.145768881 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.145967960 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.146019936 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.147084951 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.147413969 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.273190022 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.273516893 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.273561001 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.395509005 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.395553112 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.456527948 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.460526943 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.465043068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.515510082 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.515631914 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.582175016 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.635992050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.636111021 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.637890100 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.666901112 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.668482065 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.756185055 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.757936001 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.757946014 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758074045 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758102894 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758302927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758316040 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758363962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758373022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758466005 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758526087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758604050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758620977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758780956 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758789062 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758892059 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.758899927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759047031 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759054899 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759183884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759299994 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759347916 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759356976 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759572029 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759581089 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759685040 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759701014 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759800911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759855032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759917974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.759926081 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760035992 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760045052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760087967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760138988 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760183096 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760287046 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760294914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760303020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760371923 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760389090 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760515928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760524035 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760565996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760581017 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760675907 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760684013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760782957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760791063 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760880947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760889053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760977983 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.760984898 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.761025906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.761132956 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.788475990 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.792707920 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.794146061 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.881241083 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.881330967 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:41.955450058 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:41.956569910 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.001324892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.001427889 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.076726913 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.121344090 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.126575947 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.188576937 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.246635914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.246927977 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.336649895 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.336730957 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.366848946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.456923008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.456933975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457009077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457016945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457062006 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457098961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457117081 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457159996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457257986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457293034 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457365036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457375050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457436085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457479000 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457571030 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457628012 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457690954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457701921 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457743883 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457834005 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457842112 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457880020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457940102 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.457950115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458019018 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458055973 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458106041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458143950 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458184958 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458234072 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458295107 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458332062 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458380938 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458442926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458520889 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458565950 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458630085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458638906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458683968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458731890 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458770037 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.458858013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459002972 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459229946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459238052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459244967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459253073 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459259987 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459268093 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459275961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459285021 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459356070 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459364891 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.459438086 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.579875946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.579947948 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.700150967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.700697899 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.820681095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.820724010 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:42.889349937 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.940745115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:42.940850019 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.060992002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.061074972 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.081788063 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.182574987 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204086065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204154968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204199076 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204241037 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204296112 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204354048 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204385996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204408884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204485893 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204557896 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204617977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204725027 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204736948 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204766035 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204853058 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204866886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204920053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.204957962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205050945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205061913 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205197096 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205212116 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205280066 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205331087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205425024 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205471039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205569029 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205667973 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205723047 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.205734968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206301928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206315041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206326008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206336975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206347942 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206360102 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206371069 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206382036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206393003 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206403017 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206413984 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206444979 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206456900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206468105 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206490993 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206501961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206557989 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206569910 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206670046 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206681013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206695080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206758022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206806898 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.206913948 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.328252077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.328303099 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.448286057 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.448579073 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.569689989 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.572660923 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.634994030 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.693536997 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.693682909 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.765374899 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.765446901 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:43.814179897 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885488987 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885525942 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885596037 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885620117 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885756016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885767937 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885808945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885848045 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885979891 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.885992050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886027098 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886111975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886262894 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886275053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886368036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886380911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886491060 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886502028 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886590004 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886601925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886646032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886672020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886744022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886754990 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886858940 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886871099 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886914968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.886925936 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887015104 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887026072 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887140989 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887227058 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887239933 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887264013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887348890 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887361050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887470961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887481928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887521982 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887588978 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887626886 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887676954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887713909 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887726068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887774944 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887798071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887891054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887902021 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887937069 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.887955904 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.888081074 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.888093948 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.888104916 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:43.888242960 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.008282900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.010540962 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.133464098 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.134515047 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.255235910 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.255302906 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.331864119 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.331990957 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.376235008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.451982975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.452033997 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.465591908 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.572036028 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.585747004 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.585815907 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.585899115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.585994959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586045980 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586134911 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586193085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586246967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586374044 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586385965 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586534977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586574078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586729050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586740971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586796999 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586808920 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.586955070 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587003946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587124109 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587136030 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587280989 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587291956 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587349892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587467909 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587549925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587560892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587618113 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587656975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587769985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587780952 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587822914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587913036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587924957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.587969065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588037968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588076115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588170052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588202953 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588289022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588300943 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588365078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588376999 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588510990 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588635921 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588690996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588802099 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588926077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.588937044 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.589044094 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.709018946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.709080935 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.830176115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.830250978 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:44.950294971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:44.950501919 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.015607119 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.065088987 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.070542097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.070585012 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.162864923 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.162950039 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.190766096 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.283983946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284070015 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284188986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284243107 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284256935 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284354925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284378052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284476042 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284595966 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284607887 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284703016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284714937 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284784079 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284888983 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284900904 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.284931898 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285017014 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285104036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285115957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285211086 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285259008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285325050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285336971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285433054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.285445929 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.286354065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.286443949 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.406455994 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.406517029 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.526452065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.530524015 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.651670933 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.654665947 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.768552065 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.775582075 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.776082039 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.888489008 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.896125078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:45.896245003 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:45.906409979 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.063271046 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.063368082 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.069715977 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.183955908 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.190802097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.190851927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.191302061 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.191344976 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.191843033 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.191929102 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.192006111 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.192619085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.192744017 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.193228960 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.193240881 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.193785906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.193890095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194322109 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194386959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194641113 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194675922 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194731951 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194809914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194915056 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.194989920 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.195050955 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.195137024 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.195204020 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.195358992 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.195374012 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.198462009 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.210377932 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.214457989 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.319255114 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.319477081 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.335558891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.440210104 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.440258026 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.561012030 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.561065912 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.618366957 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.681082010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.681137085 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.772702932 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.772773027 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:46.801245928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893635988 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893647909 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893656015 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893666029 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893821001 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.893927097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894032955 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894083023 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894265890 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894411087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894551039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894705057 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894762993 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894864082 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.894979954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895035982 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895190001 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895296097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895394087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895525932 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895595074 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895723104 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895730972 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895780087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895860910 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.895942926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:46.898463011 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.003489971 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.019128084 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.019175053 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.123720884 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.139107943 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.139163017 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.259149075 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.259201050 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.326597929 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.379090071 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.379132986 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.435009003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.442461967 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.473452091 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.473531008 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.499099016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.563199997 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598443031 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598558903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598603964 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598654985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598804951 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598870039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.598985910 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599081039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599186897 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599281073 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599380016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599447012 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599520922 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.599694967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600007057 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600023985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600131035 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600260019 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600301981 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600436926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600480080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600579023 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600626945 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600774050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600835085 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.600984097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.602529049 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.726227045 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.726320982 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.846328974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.846421957 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:47.966356039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:47.966449976 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.032349110 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.034603119 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.089745998 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.154614925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.158550024 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.177186966 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.278996944 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297452927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297560930 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297604084 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297734022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297789097 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297909021 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.297966003 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298091888 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298167944 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298279047 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298332930 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298434019 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298544884 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298609972 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298801899 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.298913002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299005032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299068928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299174070 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299247026 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299304962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299549103 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299559116 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299566984 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.299668074 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.420128107 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.422516108 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.543086052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.543162107 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.663588047 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.663722038 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.725522995 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.725581884 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.783881903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.784003973 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.904068947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:48.906496048 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:48.918735027 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.033451080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039349079 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039478064 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039583921 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039632082 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039725065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039841890 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039899111 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.039985895 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040111065 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040287971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040296078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040343046 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040385962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040477991 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040524006 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040610075 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040816069 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040879011 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040982962 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.040998936 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.041054964 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.041143894 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.041196108 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.041292906 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.161431074 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.161506891 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.281914949 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.282021999 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.404673100 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.430464029 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.469192028 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.550823927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.568252087 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.694462061 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.814692974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:49.900716066 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:49.956918955 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.021167040 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.077877998 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.077946901 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078036070 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078175068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078254938 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078310013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078372002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078414917 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078461885 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078511953 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078557014 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078635931 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078680992 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078792095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078829050 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078898907 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.078967094 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079037905 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079133034 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079293013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079349995 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079471111 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079617977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079725027 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079790115 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.079883099 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.080018997 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.080141068 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.200318098 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.200432062 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.320410013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.320525885 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.440728903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.440778017 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.506184101 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.560940981 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.560985088 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.679646969 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.679728985 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.681005001 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800059080 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800153971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800198078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800319910 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800474882 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800496101 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800668955 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800729036 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.800915956 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801047087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801167011 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801211119 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801326990 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801420927 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801507950 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801635027 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801770926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801944017 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.801996946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802140951 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802206039 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802376032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802448988 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802555084 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802604914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802725077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802742958 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.802831888 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:50.922831059 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:50.922883034 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.042891979 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.042943001 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.163419008 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.163464069 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.206075907 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.232773066 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.283380032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.283427954 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.326559067 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.403544903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.403589964 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.428894043 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.523682117 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549217939 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549313068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549374104 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549505949 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549693108 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.549702883 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550065041 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550206900 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550373077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550571918 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550641060 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550667048 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550815105 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550911903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.550962925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551023006 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551090002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551165104 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551239967 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551328897 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551487923 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551597118 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551604986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.551718950 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.552114964 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.636877060 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.638402939 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.672698975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.672816038 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.764060020 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.798996925 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.799237013 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.850816965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.920365095 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:51.920598030 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.941088915 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:51.978877068 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.041100025 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.042634964 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.162992954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.170469046 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.176079988 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.290694952 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.297512054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.297555923 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.298518896 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.298962116 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.299704075 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.299782038 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.299864054 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.300292015 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.300301075 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.302738905 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.303653002 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304352045 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304361105 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304368973 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304377079 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304384947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304862022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.304871082 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.305495977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.305665970 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.306179047 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.306186914 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.307307959 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.307323933 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.307482958 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.308448076 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.508363962 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.630075932 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.630146027 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.723310947 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.750431061 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.839767933 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.959788084 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:52.959861994 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:52.984147072 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.080557108 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.105402946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.105494022 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.105712891 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.105813980 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106062889 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106072903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106317043 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106354952 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106442928 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106615067 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106822014 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106868029 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.106967926 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107060909 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107081890 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107172012 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107228994 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107361078 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107368946 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107563019 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107570887 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107625961 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107769966 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.107856989 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.228008986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.228054047 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.348057985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.348095894 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.468278885 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.468394995 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.532896996 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.588320971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.588417053 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.656517982 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.656586885 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.656586885 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.708626986 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.776817083 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777009964 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777019024 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777026892 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777154922 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777235985 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777292013 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777384043 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777471066 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777519941 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777529955 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777672052 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777714968 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777800083 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777900934 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.777961016 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778048992 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778110981 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778230906 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778306007 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778361082 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778476954 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778527975 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778589964 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778691053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778707981 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778716087 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.778821945 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:53.899111032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:53.899220943 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.019201040 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.019387960 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.140527010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.140853882 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.208741903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.262171984 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.262283087 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.333321095 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.382392883 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.453830004 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.453840971 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.453849077 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.453860044 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454123974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454176903 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454339981 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454647064 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454758883 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454871893 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.454977989 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455027103 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455127001 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455204010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455255032 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455306053 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455445051 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455485106 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455600977 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455652952 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455703974 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455801010 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455873966 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.455966949 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.456034899 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.456166029 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.456298113 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.576417923 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.576467037 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.696934938 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.696984053 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.818171024 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.818226099 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:54.835154057 CET	7000	49822	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:54.837177992 CET	49822	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:56.565857887 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:56.685826063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:56.685868979 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:56.807171106 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:56.996773005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:56.999542952 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:57.119756937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:57.207114935 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:51:57.209270000 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:51:57.330082893 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:52:21.838589907 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:52:21.893279076 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:52:32.276911020 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:52:32.401437044 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:52:32.711224079 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 16:52:32.752695084 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:52:32.819768906 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:02.315644026 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:02.435962915 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:02.436054945 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:02.516680956 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:02.636619091 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:17.177335024 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:17.297744036 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:17.594429970 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:17.613504887 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:17.735054016 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:21.847240925 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:21.893419027 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:31.847031116 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:32.159068108 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:32.471577883 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:32.711682081 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:32.711745977 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:32.711774111 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:33.003664017 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:33.049820900 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:33.053965092 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:33.173935890 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:46.518778086 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:46.639273882 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:46.931469917 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:46.933156967 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:53:47.053333044 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:51.857063055 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:53:51.909118891 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:54:01.191049099 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:54:01.312175989 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:54:01.603960037 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:54:01.606203079 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:54:01.727617979 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:54:02.831372976 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:54:02.951658010 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:54:03.244082928 CET	7000	50015	179.43.171.209	192.168.2.4
Nov 30, 2024 16:54:03.244858980 CET	50015	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 16:54:03.364990950 CET	7000	50015	179.43.171.209	192.168.2.4

Target ID:	0
Start time:	10:49:53
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x1f0000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1654527369.00000000001F8000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3233150482.00000000024A1000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	10:49:55
Start date:	30/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	10:49:55
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	10:49:56
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0x760000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: C:\Users\user\AppData\Roaming\github.exe, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: C:\Users\user\AppData\Roaming\github.exe, Author: ditekSHen
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 55%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	10:50:01
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0x7a0000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	10:51:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0xa50000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	10:51:59
Start date:	30/11/2024
Path:	C:\Windows\System32\WerFault.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\WerFault.exe -u -p 4464 -s 1548
Imagebase:	0x7ff6a45c0000
File size:	570'736 bytes
MD5 hash:	FD27D9F6D02763BDE32511B5DF7FF7A0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	10:52:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0x6d0000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	10:53:00
Start date:	30/11/2024
Path:	C:\Users\user\AppData\Roaming\github.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Roaming\github.exe
Imagebase:	0x260000
File size:	52'736 bytes
MD5 hash:	EFD5937F50C21B5CE660D67F3F995821
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 0000000F.00000002.4134757107.0000000002571000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	10:53:01
Start date:	30/11/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Imagebase:	0x7ff76f990000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	10:53:01
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	21.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	47.6%
Total number of Nodes:	21
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B8B11DA Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 681
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9B8B17D1

Strings

@, xrefs: 00007FFD9B8B1672

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID: @
API String ID: 544645111-2766056989
Opcode ID: ed0782c267b4d63cc8109a7907f9c96f7bbc43c0725518b759a59973a12f6db1
Instruction ID: a3078a36b28dd84fb6df66f9e041c26a2198b19d995975570af1a129cf49e829
Opcode Fuzzy Hash: ed0782c267b4d63cc8109a7907f9c96f7bbc43c0725518b759a59973a12f6db1
Instruction Fuzzy Hash: 9022EF31A28B4A8FD71CDF58C4919B5B7E1FF99300F15427EE09A87692DB34B852CB81

Function 00007FFD9B8BB2F9 Relevance: 2.4, Strings: 1, Instructions: 1170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 00007FFD9B8BBDD5

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 0803e71e6ccbcb560bce6677cb3ffce9933944d2adb4aa6a9e0349257842935e
Instruction ID: ac652ff03439fd8c903356c02dc90d8823c7ff365cc0bf852fdca6e95983416f
Opcode Fuzzy Hash: 0803e71e6ccbcb560bce6677cb3ffce9933944d2adb4aa6a9e0349257842935e
Instruction Fuzzy Hash: 86829320F1D91E4BEBA8EB788465A7976D2EF9C300F514579D01EC32D7DE28E9428B81

Function 00007FFD9B8B0F28 Relevance: 2.1, Strings: 1, Instructions: 869
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

3AL_^, xrefs: 00007FFD9B8B1F61

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID: 3AL_^
API String ID: 0-1122132868
Opcode ID: f7ff7e4a1845a87ef4884e828404fff337b2b0e0afe7f10642e38da66a3ffbbe
Instruction ID: 2bbb1e78390a2fc050306b23efaafbed66b14b1b82825ad869f028cb5746b4b4
Opcode Fuzzy Hash: f7ff7e4a1845a87ef4884e828404fff337b2b0e0afe7f10642e38da66a3ffbbe
Instruction Fuzzy Hash: F542FB61B29A1D4BE758FB7C5865AB9BBD2FF9C300F444579E01EC32D6DE28A8018781

Function 00007FFD9B8B11C8 Relevance: 1.6, Strings: 1, Instructions: 385
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FFD9B8B1672

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 9768b6116d1e8c292ff4c6cea10a4a0468151b0e1d09f71575cc26da15ff2c4a
Instruction ID: d335d4f3ffcdd8d7a0da18cdbc016aecb54aa59157294cca9b190bfe31e5fe77
Opcode Fuzzy Hash: 9768b6116d1e8c292ff4c6cea10a4a0468151b0e1d09f71575cc26da15ff2c4a
Instruction Fuzzy Hash: 08D1C071A19B4A8FD35CDF68C4A1975B7E0FF58300F45027ED09A8B6A2DB34B951CB81

Function 00007FFD9B8BD015 Relevance: 1.5, Instructions: 1478
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aafd7b3b6d0daee3480a0f228074f1aa6b4ea0a2bcbfdebf9a277e96279a8ab0
Instruction ID: 33fa51736bd70ac95a3ed501ece68e657d85f75666a490421a77e95df7e90af1
Opcode Fuzzy Hash: aafd7b3b6d0daee3480a0f228074f1aa6b4ea0a2bcbfdebf9a277e96279a8ab0
Instruction Fuzzy Hash: 1972F920B1DA198FF758AB789869678B7D2FF9C300F15457EE41DC32D6DE24A8418BC2

Function 00007FFD9B8BC8F0 Relevance: .6, Instructions: 624COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ca93de3b5b834bcb7e0c07147d68f427e4c51c8ad2c1b0eb01e8c39a9a3234
Instruction ID: fceb4d56c7a6c728904dcb7d02ea89b54f5d3fc05d27a7d7c14d43feb655c5d1
Opcode Fuzzy Hash: 97ca93de3b5b834bcb7e0c07147d68f427e4c51c8ad2c1b0eb01e8c39a9a3234
Instruction Fuzzy Hash: 6C321D70E1951D8BDB69EB64C4A5BF9B3B1FF09304F1145BAD01EA3296CE35AA81CF40

Function 00007FFD9B8BC8B0 Relevance: .6, Instructions: 563COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93042f5e93ca0437f8c75e894d2e245f913f22ce599d2271c25bc3c9663efe43
Instruction ID: 678084fba87bf246cae5497249702d79de5b32ab664798a926d85eac98877100
Opcode Fuzzy Hash: 93042f5e93ca0437f8c75e894d2e245f913f22ce599d2271c25bc3c9663efe43
Instruction Fuzzy Hash: C1122171E0991D8FEBA8DB68C8A4BB877E1FF58310F1105B9D05ED32A5DA34A981CF41

Function 00007FFD9B8B7B1A Relevance: .4, Instructions: 449COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7a81ab291a624fd8aa3a5e09ce0e2648e4d694b10e81499427680c2d60d3999
Instruction ID: 79f6f79868563f8f5af01404d98de6fa08103673529b4f62890c6a4d23ebe0b1
Opcode Fuzzy Hash: e7a81ab291a624fd8aa3a5e09ce0e2648e4d694b10e81499427680c2d60d3999
Instruction Fuzzy Hash: 98E19430A09A4D8FEBA8DF28D865BF937D1FF58310F14426EE84DC7295DB34A9458B81

Function 00007FFD9B8B8C55 Relevance: .4, Instructions: 434COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acae1377befead6744da5a0bc24a0c9d1e2913f0da2ddf8b6f0785dff02af765
Instruction ID: 78b2e8eab12ce434ec29cf33710f0208ab7ec53f2447274eeee256e91e90edd5
Opcode Fuzzy Hash: acae1377befead6744da5a0bc24a0c9d1e2913f0da2ddf8b6f0785dff02af765
Instruction Fuzzy Hash: 12E19230A09A4D8FEBA8DF68C8657E977D1FF58310F14426AE80DC76A5DF34A9418BC1

Function 00007FFD9B8BE20D Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8878c72f9c6a94edb7ea1bad82dd129c9e4367f00f89d686ef31511f89ad786a
Instruction ID: 72e2d1e447c85f5e2a03689b9d010c546430e11cd66a8d2faf969326b7713254
Opcode Fuzzy Hash: 8878c72f9c6a94edb7ea1bad82dd129c9e4367f00f89d686ef31511f89ad786a
Instruction Fuzzy Hash: 3551DE70E1951D8FDB98EFA8C4A5AACBBF1FF59301F111569D01EE72A2CA34A941CF40

Function 00007FFD9B8B0DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNEL32 ref: 00007FFD9B8B17D1

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bb2412e0f129fabd5c71594ee724acd6210095a61870afb2ee45add3208cd2e5
Instruction ID: 2d2e4f5c04aeda76a734826a5d4f64ba6f1b267ab460125b36665340bd401b81
Opcode Fuzzy Hash: bb2412e0f129fabd5c71594ee724acd6210095a61870afb2ee45add3208cd2e5
Instruction Fuzzy Hash: 4831E830A0CA1C8FDB1CEF99D845AF977E5EB59321F00422FD04AD3291CB706852CB85

Function 00007FFD9B8B1814 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3236701555.00007FFD9B8B0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ffd9b8b0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c17092ab7d69e2a0f6137cf1c8b28da930b94f03faa91a11b378af2557817ba
Instruction ID: c94c4497ea72ac0b163f1763b3646553336ff994fda3a42dc0ac4b208ec2dd4f
Opcode Fuzzy Hash: 0c17092ab7d69e2a0f6137cf1c8b28da930b94f03faa91a11b378af2557817ba
Instruction Fuzzy Hash: 01310A31B4D50E4FD31CAB6CA4655E8BFA1FB95311B8041A5E05A837CBEE74A412C7D2

Analysis Process: github.exePID: 5332, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	13.8%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9B890DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8917D1

Memory Dump Source

Source File: 00000003.00000002.1685340024.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction ID: 045f63715b4bdba7c5bf3fa0c3f33ad4dad4ee28622d1648fc6615d6dae2f167
Opcode Fuzzy Hash: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction Fuzzy Hash: 6031C830A0CA1C9FDB1CEF99D8496F9BBE5EB59321F00422FD04AD3291CB706856CB95

Function 00007FFD9B891814 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000003.00000002.1685340024.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_7ffd9b890000_github.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2ba5cac53117a5df6e724e3b651f5fb204cd27e7599a03a2bd9241805c186da
Instruction ID: eb88e9cd67ab9d320d0304707c2cc7027b70f7371bdd51857520742814a5271d
Opcode Fuzzy Hash: d2ba5cac53117a5df6e724e3b651f5fb204cd27e7599a03a2bd9241805c186da
Instruction Fuzzy Hash: FD312C3574C60A5FD74CE768A8626A9BFA1EF49310F8041ADD45CC37CBDF7864068762

Analysis Process: github.exePID: 3612, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9B890DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8917D1

Memory Dump Source

Source File: 00000004.00000002.1740013453.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b890000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction ID: 045f63715b4bdba7c5bf3fa0c3f33ad4dad4ee28622d1648fc6615d6dae2f167
Opcode Fuzzy Hash: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction Fuzzy Hash: 6031C830A0CA1C9FDB1CEF99D8496F9BBE5EB59321F00422FD04AD3291CB706856CB95

Function 00007FFD9B891814 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000004.00000002.1740013453.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_7ffd9b890000_github.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 831ecc45174d7068e4292fd2e757da84f102311ce3280ca77c030a79a32e2252
Instruction ID: 251b782a21adbb0a3c7e08d2783d9a0baa2900a98502c65b6fc46099876d3bc8
Opcode Fuzzy Hash: 831ecc45174d7068e4292fd2e757da84f102311ce3280ca77c030a79a32e2252
Instruction Fuzzy Hash: 9631EA3174D64A5FE30CAB58E462AB4BFA1EF45350F8042A9D45CC37CBDA38A5068752

Analysis Process: github.exePID: 6288, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9B8A0DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8A17D1

Memory Dump Source

Source File: 00000008.00000002.2331150117.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d0d015a1a3ffc42edd828b877279f612afb778c277c03b0002b3c41482d71060
Instruction ID: 8a254119301cbb674f62d85fed2d32308b5e796cdc21c5965cdf4e6b4e0092af
Opcode Fuzzy Hash: d0d015a1a3ffc42edd828b877279f612afb778c277c03b0002b3c41482d71060
Instruction Fuzzy Hash: 7D31C830A0CA1C8FDB1CEF99D8456F977E5EB59321F10422FD04AD3291DB706856CB95

Function 00007FFD9B8A1814 Relevance: 1.6, APIs: 1, Instructions: 95
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000008.00000002.2331150117.00007FFD9B8A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B8A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_7ffd9b8a0000_github.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f15611bd5201b378f949523523371d83bf06163959422b658456b16874de457
Instruction ID: 005d57436d79199b8d26a769e58261abe3070f3ee1e76ed201be89270fa8f535
Opcode Fuzzy Hash: 7f15611bd5201b378f949523523371d83bf06163959422b658456b16874de457
Instruction Fuzzy Hash: 5831CA7174D64A8FD70CEB78E461AB4BFA1EF45350F8041A5D059837CAEF386452C7A2

Analysis Process: github.exePID: 4548, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	14%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	8
Total number of Limit Nodes:	1

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD9B890DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9B8917D1

Memory Dump Source

Source File: 0000000D.00000002.2929707388.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b890000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction ID: 045f63715b4bdba7c5bf3fa0c3f33ad4dad4ee28622d1648fc6615d6dae2f167
Opcode Fuzzy Hash: a60ff1215a20864aaabaae0d865bfd73a192cc019f3bea0550f9ecc41948ad65
Instruction Fuzzy Hash: 6031C830A0CA1C9FDB1CEF99D8496F9BBE5EB59321F00422FD04AD3291CB706856CB95

Function 00007FFD9B891814 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000D.00000002.2929707388.00007FFD9B890000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B890000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_7ffd9b890000_github.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 189480a4955279c1d5443d85850eb2e69e14b6f7840711cd803cc134eb06c7dd
Instruction ID: 9424242c6c7328ad865133a6490e481d6d19df7c2396a41a20fab6c816d526c1
Opcode Fuzzy Hash: 189480a4955279c1d5443d85850eb2e69e14b6f7840711cd803cc134eb06c7dd
Instruction Fuzzy Hash: A9312C3574D64A5FD30CEB58A861AA4BFA1EF45350F8041A9D05CC37CBDF7C64068762

Analysis Process: github.exePID: 6048, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	18.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9BAD0DE2 Relevance: 1.6, APIs: 1, Instructions: 111
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 00007FFD9BAD17D1

Memory Dump Source

Source File: 0000000F.00000002.4136719326.00007FFD9BAD0000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BAD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_7ffd9bad0000_github.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: bb2412e0f129fabd5c71594ee724acd6210095a61870afb2ee45add3208cd2e5
Instruction ID: c0c0ffcedef49ee6d2fccb8acce69bff7712049e52d7d2d07bd5c14df11a7069
Opcode Fuzzy Hash: bb2412e0f129fabd5c71594ee724acd6210095a61870afb2ee45add3208cd2e5
Instruction Fuzzy Hash: 8F31C831A0CA1C8FDB1CDF99D845AF9B7E5EBA9311F00422FD04AD3291DB706856CB95

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_489542ce3eb4b4cc3c3bd7df7e4d98eb5ea1839_8bc8969b_736690da-bad7-4558-90ec-2c5b112d0ce3\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9F9F.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA155.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA175.tmp.xml

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\github.exe.log

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

C:\Users\user\AppData\Roaming\github.exe

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

Windows Analysis Report
file.exe

Function 00007FFD9B8B11DA Relevance: 4.2, APIs: 1, Strings: 1, Instructions: 681
memoryCOMMON

Function 00007FFD9B8BB2F9 Relevance: 2.4, Strings: 1, Instructions: 1170
COMMON

Function 00007FFD9B8B0F28 Relevance: 2.1, Strings: 1, Instructions: 869
COMMON

Function 00007FFD9B8B11C8 Relevance: 1.6, Strings: 1, Instructions: 385
COMMON

Function 00007FFD9B8BD015 Relevance: 1.5, Instructions: 1478
COMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre