Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1565730
MD5:	7ac5198e128deda55eeeb6ccfc8b57ea
SHA1:	96b58d89ddfedda3dc8daebb4391abe40843253e
SHA256:	887a2e09a1e373ad3f5224a8464b0e5b4ebe4a344958c2d9c91cbd42a54f1241
Tags:	exeuser-Bitsight
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides threads from debuggers

Machine Learning detection for sample

PE file contains section with special chars

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Uses schtasks.exe or at.exe to add and modify task schedules

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Entry point lies outside standard sections

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

One or more processes crash

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 7528 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 7AC5198E128DEDA55EEEB6CCFC8B57EA)

schtasks.exe (PID: 7712 cmdline: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe" MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7720 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

WerFault.exe (PID: 4944 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 2632 MD5: C31336C1EFC2CCB44B4326EA793040F2)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6fdf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x70f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d7e:$cnc4: POST / HTTP/1.1
00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x6f42:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x6fdf:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x70f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x6d7e:$cnc4: POST / HTTP/1.1
00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: file.exe PID: 7528	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Click to see the 1 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.file.exe.800000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.2.file.exe.800000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7342:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x73df:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x74f4:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x717e:$cnc4: POST / HTTP/1.1

Sigma Signatures

System Summary

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\file.exe, ProcessId: 7528, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 7528, ParentProcessName: file.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe", ProcessId: 7712, ProcessName: schtasks.exe

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T17:20:09.010710+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:19.643363+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:22.214594+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:30.299793+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:40.975938+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:51.611824+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:52.221493+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.300061+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.501283+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.702545+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.836221+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:58.523684+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:58.726283+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:58.927385+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.175390+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.429051+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.826371+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.220954+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.572970+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.684049+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.817675+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:01.674936+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:01.876034+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.026735+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.150407+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.475069+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.716808+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.798538+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.004746+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.280556+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.525261+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.606363+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:04.835903+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.283334+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.587885+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.788977+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.002525+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.144230+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.248777+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.470566+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:07.157688+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:07.358637+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.122943+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.308332+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.364889+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.432265+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.676654+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.878075+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.208438+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.350039+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.538230+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.677063+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.945229+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.135086+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.537834+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.722492+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.848447+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.139281+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.300906+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.420972+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.689039+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.977024+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.276870+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.599489+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.864702+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:13.468252+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:13.793135+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:13.914209+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.137117+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.235993+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.338261+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.990310+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:15.337206+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:15.792336+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.047084+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.265635+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.489747+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.586999+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.610277+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.706993+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.943682+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:17.192697+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.019409+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.173412+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.347796+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.989897+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:19.271106+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:19.581049+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:20.768322+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:20.915720+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.045838+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.169534+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.673838+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.950021+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.072285+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.151360+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.553728+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.678499+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:23.936828+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.138116+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.428499+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.583203+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.784286+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.035670+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.226072+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.359924+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.653275+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:26.659268+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:26.810089+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:27.055801+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:27.423442+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:27.594974+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.063602+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.385566+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.508667+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.012362+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.260786+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.341052+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.582762+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.749619+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.993442+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.247616+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.365092+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.566902+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.654341+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.771208+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.888216+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.008185+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.107607+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.356718+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.422992+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.543451+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.664643+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.744366+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.945541+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.046171+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.165624+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.408710+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.652707+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.730183+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.853771+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.931303+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.052507+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.273089+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.373996+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.494034+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.615675+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.699343+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.819404+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.937354+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.146673+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.185318+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.319611+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.386456+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.467917+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.587596+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.822725+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.222520+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.501709+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.741127+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.904853+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.984703+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.078518+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.185877+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.407888+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.670526+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.793084+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:38.681967+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:38.825002+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.373600+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.496390+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.616607+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.693286+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.817684+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.894018+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.143981+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.264621+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.388721+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:41.811656+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.012797+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.576102+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.697012+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.820984+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.942147+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.062207+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.142475+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.368377+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.816319+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.030788+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.154611+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.300168+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.866152+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.948367+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:45.069032+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:45.451221+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:52.236844+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:22:12.887645+0100	2852870	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T17:20:09.245403+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:19.645453+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:30.302783+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:40.977605+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:51.614357+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.390071+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.510176+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.801462+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.921504+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:58.614643+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:58.846503+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.253649+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.500582+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.872423+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.234009+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.496387+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.616370+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.771455+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.949361+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:01.705483+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:01.917490+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.039160+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.163768+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.518922+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.765160+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.008842+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.283530+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.452108+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.525609+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.609512+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.939473+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.082277+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.202510+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.838588+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:05.284859+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:05.822962+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.129911+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.248891+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.311705+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.471938+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:07.160354+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:07.366014+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.365000+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.391474+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.485097+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.209974+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.352971+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.809514+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.946512+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:10.814591+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:11.387887+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:11.690327+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.143642+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.278225+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.727657+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.866430+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:13.470601+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:13.877828+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.203520+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.265497+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.431464+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.012562+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.219611+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.339581+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.821799+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.064012+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.288236+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.505748+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.610319+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.632546+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:17.280955+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.026519+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.176484+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.348419+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.991945+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.280058+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.641471+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.835968+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.956405+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:20.968158+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.091430+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.341476+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.749806+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:22.235529+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:22.498972+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:23.131037+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:23.986641+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:24.189533+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:24.875730+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.038643+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.331980+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.499508+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.672941+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:26.734380+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:26.854602+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:27.151493+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:27.425408+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.072836+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.295589+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.385826+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.417526+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.601560+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.013234+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.341553+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.583589+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.037548+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.331551+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.570138+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.686962+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.806953+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.892544+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.015911+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.423040+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.745550+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.964190+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:33.474752+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.114406+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.292710+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.498249+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.619590+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.739784+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.984099+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.185386+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.305420+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.386537+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.891457+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.300524+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.510442+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.754633+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.984767+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.067523+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.192653+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.471596+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.682296+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.907377+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:38.915611+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.451317+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.615783+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.779486+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.895566+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.940572+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.158851+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.351694+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.472045+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:41.814292+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.013577+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.619959+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.740975+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.861091+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:43.143783+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:43.383783+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:43.829587+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:44.056667+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:44.948422+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:22:12.165081+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T17:20:22.214594+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:52.221493+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:52.236844+0100	2852874	1	Malware Command and Control Activity Detected	179.43.171.209	7000	192.168.2.4	49730	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-30T17:20:59.992727+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.4	49730	179.43.171.209	7000	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Found malware configuration

Source: 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: Xworm {"C2 url": ["179.43.171.209"], "Port": 7000, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe", "Version": "XWorm V5.6"}

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 31%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.file.exe.800000.0.unpack	String decryptor: 179.43.171.209
Source: 0.2.file.exe.800000.0.unpack	String decryptor: 7000
Source: 0.2.file.exe.800000.0.unpack	String decryptor: <123456789>
Source: 0.2.file.exe.800000.0.unpack	String decryptor: <Xwormmm>
Source: 0.2.file.exe.800000.0.unpack	String decryptor: XWorm V5.6
Source: 0.2.file.exe.800000.0.unpack	String decryptor: USB.exe
Source: 0.2.file.exe.800000.0.unpack	String decryptor: %AppData%
Source: 0.2.file.exe.800000.0.unpack	String decryptor: github.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: e.PDBl source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3033379354.0000000001499000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbdbib.pdb# source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdbME source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: lib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: 5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbL}2 source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: \mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: ile.PDB source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: %%.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdbxX source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp, WERB1AB.tmp.dmp.9.dr
Source:	Binary string: C:\Windows\dll\mscorlib.pdbHI source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb] source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbH source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdbMZ source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 179.43.171.209:7000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.4:49730 -> 179.43.171.209:7000
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 179.43.171.209:7000 -> 192.168.2.4:49730
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.4:49730 -> 179.43.171.209:7000

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 179.43.171.209

Source: global traffic

TCP traffic: 192.168.2.4:49730 -> 179.43.171.209:7000

Source: Joe Sandbox View

ASN Name: PLI-ASCH PLI-ASCH

Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209
Source: unknown	TCP traffic detected without corresponding DNS query: 179.43.171.209

Source: file.exe, 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.9.dr	String found in binary or memory: http://upx.sf.net

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.file.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0536441F	0_2_0536441F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0536A1B0	0_2_0536A1B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05361030	0_2_05361030
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0536E370	0_2_0536E370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0536BD70	0_2_0536BD70
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0536DD48	0_2_0536DD48
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_053698E0	0_2_053698E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05364A68	0_2_05364A68
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05369598	0_2_05369598
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_05361768	0_2_05361768
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_091A27F8	0_2_091A27F8

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 2632

Source: file.exe, 00000000.00000002.3032535505.000000000080A000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamegithub.exe4 vs file.exe
Source: file.exe, 00000000.00000002.3033379354.00000000013AE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs file.exe
Source: file.exe, 00000000.00000002.3035063096.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamegithub.exe4 vs file.exe
Source: file.exe	Binary or memory string: OriginalFilenamegithub.exe4 vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0.2.file.exe.800000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: file.exe

Static PE information: Section: dvpnmyli ZLIB complexity 0.9949074161862864

Source: classification engine

Classification label: mal100.troj.evad.winEXE@5/6@0/1

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7720:120:WilError_03
Source: C:\Users\user\Desktop\file.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\file.exe	Mutant created: \Sessions\1\BaseNamedObjects\aKo7AtdK4OEvATqs
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7528

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\885930dd-e236-4c80-b0f6-153ca64a3619

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: file.exe

ReversingLabs: Detection: 31%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: file.exe	String found in binary or memory: 3The file %s is missing. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 2632
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F5FB2C77-0E2F-4A16-A381-3E560C68BC83}\InProcServer32

Jump to behavior

Source: github.lnk.0.dr

LNK file: ..\..\..\..\..\github.exe

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: file.exe

Static file information: File size 1723904 > 1048576

Source: file.exe

Static PE information: Raw size of dvpnmyli is bigger than: 0x100000 < 0x19c000

Source:	Binary string: e.PDBl source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: \??\C:\Windows\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3033379354.0000000001499000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbdbib.pdb# source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\dll\mscorlib.pdbME source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: lib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: n0C:\Windows\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: 5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: C:\Windows\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbL}2 source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: \mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Xml.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: ile.PDB source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp, file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: o.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Xml.ni.pdbRSDS# source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: Microsoft.VisualBasic.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: %%.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Windows.Forms.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Windows.Forms.pdbxX source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083D2000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp, WERB1AB.tmp.dmp.9.dr
Source:	Binary string: C:\Windows\dll\mscorlib.pdbHI source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Windows\symbols\dll\mscorlib.pdb source: file.exe, 00000000.00000002.3036935350.00000000083A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Windows\mscorlib.pdbpdblib.pdb] source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Management.ni.pdbRSDSJ< source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: mscorlib.pdbcorlib.pdbpdblib.pdbC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Drawing.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Management.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: oC:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.pdbH source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: mscorlib.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Management.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.pdbMZ source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: symbols\dll\mscorlib.pdbLb source: file.exe, 00000000.00000002.3036846303.000000000823A000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: System.Configuration.ni.pdbRSDScUN source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.ni.pdb source: WERB1AB.tmp.dmp.9.dr
Source:	Binary string: System.Core.ni.pdbRSDS source: WERB1AB.tmp.dmp.9.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe

Unpacked PE file: 0.2.file.exe.800000.0.unpack :EW;.rsrc:W;.idata :W; :EW;dvpnmyli:EW;lhlewnhz:EW;.taggant:EW; vs :ER;.rsrc:W;

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: file.exe

Static PE information: real checksum: 0x1ab3ef should be: 0x1adb14

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: dvpnmyli
Source: file.exe	Static PE information: section name: lhlewnhz
Source: file.exe	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_05365CB8 push eax; retf

0_2_05365CB9

Source: file.exe	Static PE information: section name: entropy: 7.928832262074926
Source: file.exe	Static PE information: section name: dvpnmyli entropy: 7.95384464177905

Boot Survival

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__			Jump to behavior

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 985F31 second address: 985F44 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007FAD68536506h 0x0000000a jl 00007FAD68536506h 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 979F05 second address: 979F36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAD6938CD1Ch 0x0000000b push esi 0x0000000c pop esi 0x0000000d popad 0x0000000e jmp 00007FAD6938CD1Fh 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007FAD6938CD1Bh 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 984F5F second address: 984F69 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAD68536506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9852BF second address: 9852C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAD6938CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857DE second address: 9857E3 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857E3 second address: 9857F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007FAD6938CD16h 0x0000000a pop ebx 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9857F1 second address: 9857F7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9893F5 second address: 9893F9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9893F9 second address: 98940F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 push eax 0x00000008 jng 00007FAD68536514h 0x0000000e push eax 0x0000000f push edx 0x00000010 js 00007FAD68536506h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98940F second address: 98942D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 mov edx, 50A55E00h 0x0000000c push 00000000h 0x0000000e mov ecx, dword ptr [ebp+13A82DD1h] 0x00000014 push C849453Ah 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d pop eax 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98942D second address: 98943B instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98943B second address: 98943F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98943F second address: 9894A7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 add dword ptr [esp], 37B6BB46h 0x0000000e clc 0x0000000f push 00000003h 0x00000011 mov si, B912h 0x00000015 push 00000000h 0x00000017 or dx, 8446h 0x0000001c push 00000003h 0x0000001e mov edx, 577E69C1h 0x00000023 call 00007FAD68536509h 0x00000028 jmp 00007FAD6853650Eh 0x0000002d push eax 0x0000002e jmp 00007FAD68536510h 0x00000033 mov eax, dword ptr [esp+04h] 0x00000037 jmp 00007FAD6853650Eh 0x0000003c mov eax, dword ptr [eax] 0x0000003e pushad 0x0000003f push eax 0x00000040 push edx 0x00000041 jbe 00007FAD68536506h 0x00000047 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9894A7 second address: 9894B4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD6938CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9894B4 second address: 9894D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 mov dword ptr [esp+04h], eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAD68536510h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9894D2 second address: 989541 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD1Dh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a push 00000000h 0x0000000c push ebx 0x0000000d call 00007FAD6938CD18h 0x00000012 pop ebx 0x00000013 mov dword ptr [esp+04h], ebx 0x00000017 add dword ptr [esp+04h], 00000018h 0x0000001f inc ebx 0x00000020 push ebx 0x00000021 ret 0x00000022 pop ebx 0x00000023 ret 0x00000024 or dword ptr [ebp+13A81A32h], eax 0x0000002a lea ebx, dword ptr [ebp+13BFB2A2h] 0x00000030 jo 00007FAD6938CD32h 0x00000036 call 00007FAD6938CD29h 0x0000003b mov edx, ecx 0x0000003d pop ecx 0x0000003e xchg eax, ebx 0x0000003f jc 00007FAD6938CD28h 0x00000045 push eax 0x00000046 push edx 0x00000047 jo 00007FAD6938CD16h 0x0000004d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989541 second address: 989545 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989545 second address: 98956D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 pushad 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b jmp 00007FAD6938CD28h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9897E6 second address: 98985C instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop esi 0x00000007 pop eax 0x00000008 mov ecx, 69FD7F9Eh 0x0000000d push 00000003h 0x0000000f mov dh, 78h 0x00000011 mov dword ptr [ebp+13A81B10h], eax 0x00000017 push 00000000h 0x00000019 push 00000000h 0x0000001b push ecx 0x0000001c call 00007FAD68536508h 0x00000021 pop ecx 0x00000022 mov dword ptr [esp+04h], ecx 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc ecx 0x0000002f push ecx 0x00000030 ret 0x00000031 pop ecx 0x00000032 ret 0x00000033 push 00000003h 0x00000035 push 00000000h 0x00000037 push edi 0x00000038 call 00007FAD68536508h 0x0000003d pop edi 0x0000003e mov dword ptr [esp+04h], edi 0x00000042 add dword ptr [esp+04h], 0000001Ah 0x0000004a inc edi 0x0000004b push edi 0x0000004c ret 0x0000004d pop edi 0x0000004e ret 0x0000004f jnp 00007FAD68536508h 0x00000055 mov edi, eax 0x00000057 mov dword ptr [ebp+13A82DD1h], esi 0x0000005d call 00007FAD68536509h 0x00000062 pushad 0x00000063 push eax 0x00000064 push edx 0x00000065 push eax 0x00000066 push edx 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 98985C second address: 989860 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 989860 second address: 98987C instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jg 00007FAD6853650Ch 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push ecx 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8EC1 second address: 9A8F12 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAD6938CD1Eh 0x00000008 pushad 0x00000009 jo 00007FAD6938CD16h 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 push ebx 0x00000012 pop ebx 0x00000013 popad 0x00000014 pop edx 0x00000015 pop eax 0x00000016 push eax 0x00000017 push edx 0x00000018 push edi 0x00000019 jmp 00007FAD6938CD1Ch 0x0000001e jmp 00007FAD6938CD29h 0x00000023 pop edi 0x00000024 push eax 0x00000025 push edx 0x00000026 pushad 0x00000027 popad 0x00000028 jng 00007FAD6938CD16h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8F12 second address: 9A8F2B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536513h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8F2B second address: 9A8F32 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 96FFD1 second address: 96FFFF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pop esi 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD68536510h 0x00000011 jmp 00007FAD68536512h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6FA9 second address: 9A6FAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A6FAD second address: 9A6FB1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A70F3 second address: 9A70F7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A70F7 second address: 9A70FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A70FD second address: 9A7121 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007FAD6938CD1Ch 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007FAD6938CD20h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7121 second address: 9A7143 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 js 00007FAD68536506h 0x0000000e jmp 00007FAD68536514h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7143 second address: 9A714F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A714F second address: 9A7155 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7155 second address: 9A7159 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7159 second address: 9A715D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A715D second address: 9A717C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAD6938CD23h 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A717C second address: 9A7180 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7180 second address: 9A7184 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7404 second address: 9A740A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A740A second address: 9A740E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A75C0 second address: 9A75E1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6853650Dh 0x00000007 ja 00007FAD68536506h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop esi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 jc 00007FAD68536506h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A79E3 second address: 9A79ED instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD6938CD1Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A79ED second address: 9A7A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 jmp 00007FAD68536515h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A0D second address: 9A7A12 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7A12 second address: 9A7A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7CF6 second address: 9A7CFC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A7E4B second address: 9A7E5B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push esi 0x00000006 jng 00007FAD68536506h 0x0000000c pop esi 0x0000000d push esi 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99E486 second address: 99E48A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BBBD second address: 97BBC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jbe 00007FAD68536506h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BBC9 second address: 97BBCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BBCD second address: 97BBEC instructions: 0x00000000 rdtsc 0x00000002 js 00007FAD68536506h 0x00000008 jno 00007FAD68536506h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pushad 0x00000011 jmp 00007FAD6853650Ch 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BBEC second address: 97BBF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BBF2 second address: 97BC16 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push edi 0x0000000a jmp 00007FAD68536511h 0x0000000f pop edi 0x00000010 jno 00007FAD68536508h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BC16 second address: 97BC22 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jns 00007FAD6938CD16h 0x0000000a push ecx 0x0000000b pop ecx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97BC22 second address: 97BC28 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A85B4 second address: 9A85D6 instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAD6938CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007FAD6938CD1Ch 0x0000000f pop ebx 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 popad 0x00000015 js 00007FAD6938CD16h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A85D6 second address: 9A85FE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6853650Ah 0x00000007 jmp 00007FAD68536515h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8774 second address: 9A8784 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007FAD6938CD16h 0x0000000a ja 00007FAD6938CD16h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8784 second address: 9A878E instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A878E second address: 9A8792 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8792 second address: 9A8796 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9A8A50 second address: 9A8A65 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jo 00007FAD6938CD16h 0x0000000d jbe 00007FAD6938CD16h 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD423 second address: 9AD427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD427 second address: 9AD432 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD432 second address: 9AD43A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AD43A second address: 9AD440 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE9D9 second address: 9AE9DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9AE9DD second address: 9AE9EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jbe 00007FAD6938CD1Eh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B06A5 second address: 9B06E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD68536513h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c popad 0x0000000d pushad 0x0000000e push ecx 0x0000000f je 00007FAD68536506h 0x00000015 jmp 00007FAD68536518h 0x0000001a pop ecx 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B06E5 second address: 9B06FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6938CD21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F18E second address: 97F192 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F192 second address: 97F1BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop edi 0x00000009 pushad 0x0000000a js 00007FAD6938CD18h 0x00000010 push ebx 0x00000011 pop ebx 0x00000012 push eax 0x00000013 push edx 0x00000014 jmp 00007FAD6938CD24h 0x00000019 push esi 0x0000001a pop esi 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 97F1BC second address: 97F1C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B3667 second address: 9B366C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B25BD second address: 9B25C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B36E0 second address: 9B36E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B36E4 second address: 9B36EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B77BA second address: 9B77BE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B77BE second address: 9B77D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007FAD6853650Fh 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B77D7 second address: 9B7811 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAD6938CD29h 0x0000000f jmp 00007FAD6938CD27h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7811 second address: 9B781B instructions: 0x00000000 rdtsc 0x00000002 jo 00007FAD68536506h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7C17 second address: 9B7C1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7C1B second address: 9B7C3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ecx 0x0000000a push eax 0x0000000b push edx 0x0000000c jns 00007FAD68536506h 0x00000012 jmp 00007FAD68536512h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B7E10 second address: 9B7E14 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA139 second address: 9BA13D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA966 second address: 9BA9C0 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD6938CD1Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], ebx 0x0000000d pushad 0x0000000e mov cx, 2F04h 0x00000012 pushad 0x00000013 jmp 00007FAD6938CD22h 0x00000018 sbb ebx, 6C92B71Fh 0x0000001e popad 0x0000001f popad 0x00000020 nop 0x00000021 pushad 0x00000022 jl 00007FAD6938CD18h 0x00000028 pushad 0x00000029 push esi 0x0000002a pop esi 0x0000002b jmp 00007FAD6938CD22h 0x00000030 popad 0x00000031 popad 0x00000032 push eax 0x00000033 push eax 0x00000034 push edx 0x00000035 push eax 0x00000036 push eax 0x00000037 push edx 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BA9C0 second address: 9BA9C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BADA6 second address: 9BADAB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BAF10 second address: 9BAF6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD68536511h 0x00000008 push eax 0x00000009 pop eax 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov dword ptr [esp], eax 0x00000010 push 00000000h 0x00000012 push ecx 0x00000013 call 00007FAD68536508h 0x00000018 pop ecx 0x00000019 mov dword ptr [esp+04h], ecx 0x0000001d add dword ptr [esp+04h], 0000001Ah 0x00000025 inc ecx 0x00000026 push ecx 0x00000027 ret 0x00000028 pop ecx 0x00000029 ret 0x0000002a xchg eax, ebx 0x0000002b jmp 00007FAD68536518h 0x00000030 push eax 0x00000031 push edx 0x00000032 push esi 0x00000033 push eax 0x00000034 push edx 0x00000035 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BB474 second address: 9BB478 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBDF0 second address: 9BBDF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBDF4 second address: 9BBE12 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD25h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBE12 second address: 9BBE87 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push 00000000h 0x0000000d push ecx 0x0000000e call 00007FAD68536508h 0x00000013 pop ecx 0x00000014 mov dword ptr [esp+04h], ecx 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ecx 0x00000021 push ecx 0x00000022 ret 0x00000023 pop ecx 0x00000024 ret 0x00000025 mov di, si 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ecx 0x0000002d call 00007FAD68536508h 0x00000032 pop ecx 0x00000033 mov dword ptr [esp+04h], ecx 0x00000037 add dword ptr [esp+04h], 00000014h 0x0000003f inc ecx 0x00000040 push ecx 0x00000041 ret 0x00000042 pop ecx 0x00000043 ret 0x00000044 pushad 0x00000045 mov dword ptr [ebp+13A82F03h], esi 0x0000004b jnc 00007FAD68536506h 0x00000051 popad 0x00000052 mov dword ptr [ebp+13A81997h], eax 0x00000058 xchg eax, ebx 0x00000059 jnp 00007FAD6853650Ah 0x0000005f push eax 0x00000060 push eax 0x00000061 push edx 0x00000062 je 00007FAD6853650Ch 0x00000068 push eax 0x00000069 push edx 0x0000006a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BBE87 second address: 9BBE8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE542 second address: 9BE546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BE546 second address: 9BE54A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0600 second address: 9C060A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FAD68536506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C060A second address: 9C0688 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD23h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b nop 0x0000000c push 00000000h 0x0000000e push esi 0x0000000f call 00007FAD6938CD18h 0x00000014 pop esi 0x00000015 mov dword ptr [esp+04h], esi 0x00000019 add dword ptr [esp+04h], 00000014h 0x00000021 inc esi 0x00000022 push esi 0x00000023 ret 0x00000024 pop esi 0x00000025 ret 0x00000026 add edi, dword ptr [ebp+13A838E7h] 0x0000002c push 00000000h 0x0000002e push 00000000h 0x00000030 push eax 0x00000031 call 00007FAD6938CD18h 0x00000036 pop eax 0x00000037 mov dword ptr [esp+04h], eax 0x0000003b add dword ptr [esp+04h], 00000019h 0x00000043 inc eax 0x00000044 push eax 0x00000045 ret 0x00000046 pop eax 0x00000047 ret 0x00000048 mov dword ptr [ebp+13BF8E55h], edx 0x0000004e push 00000000h 0x00000050 mov esi, dword ptr [ebp+13BF6F0Fh] 0x00000056 mov dword ptr [ebp+13A830F1h], ecx 0x0000005c push eax 0x0000005d push eax 0x0000005e push edx 0x0000005f push eax 0x00000060 push edx 0x00000061 jng 00007FAD6938CD16h 0x00000067 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0688 second address: 9C068C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD808 second address: 9BD80D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C068C second address: 9C0692 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BD80D second address: 9BD813 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0692 second address: 9C0698 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C0698 second address: 9C069C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1B4C second address: 9C1B51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1B51 second address: 9C1B65 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD6938CD20h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C1B65 second address: 9C1BDB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536515h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007FAD68536508h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 00000016h 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 sub dword ptr [ebp+13C182CFh], edi 0x0000002e push 00000000h 0x00000030 mov si, 00A3h 0x00000034 call 00007FAD68536518h 0x00000039 mov esi, 114EED45h 0x0000003e pop edi 0x0000003f push 00000000h 0x00000041 mov si, 9347h 0x00000045 xchg eax, ebx 0x00000046 push ecx 0x00000047 push eax 0x00000048 push edx 0x00000049 jne 00007FAD68536506h 0x0000004f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C3AB2 second address: 9C3AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6938CD1Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C6B3B second address: 9C6B3F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7BF6 second address: 9C7BFF instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7BFF second address: 9C7C05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C7C05 second address: 9C7C77 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], eax 0x00000009 push 00000000h 0x0000000b push edx 0x0000000c call 00007FAD6938CD18h 0x00000011 pop edx 0x00000012 mov dword ptr [esp+04h], edx 0x00000016 add dword ptr [esp+04h], 0000001Ah 0x0000001e inc edx 0x0000001f push edx 0x00000020 ret 0x00000021 pop edx 0x00000022 ret 0x00000023 clc 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ebp 0x00000029 call 00007FAD6938CD18h 0x0000002e pop ebp 0x0000002f mov dword ptr [esp+04h], ebp 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc ebp 0x0000003c push ebp 0x0000003d ret 0x0000003e pop ebp 0x0000003f ret 0x00000040 mov bh, AEh 0x00000042 mov dword ptr [ebp+13A81AC1h], eax 0x00000048 push 00000000h 0x0000004a sub ebx, dword ptr [ebp+13A82A3Ah] 0x00000050 jno 00007FAD6938CD18h 0x00000056 xchg eax, esi 0x00000057 push eax 0x00000058 push edx 0x00000059 ja 00007FAD6938CD18h 0x0000005f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5DE2 second address: 9C5DE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5DE9 second address: 9C5E0B instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAD6938CD23h 0x00000008 jmp 00007FAD6938CD1Dh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 je 00007FAD6938CD28h 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5E0B second address: 9C5E0F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5E0F second address: 9C5E13 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C5E13 second address: 9C5EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebx 0x0000000a call 00007FAD68536508h 0x0000000f pop ebx 0x00000010 mov dword ptr [esp+04h], ebx 0x00000014 add dword ptr [esp+04h], 0000001Ch 0x0000001c inc ebx 0x0000001d push ebx 0x0000001e ret 0x0000001f pop ebx 0x00000020 ret 0x00000021 movsx ebx, si 0x00000024 push dword ptr fs:[00000000h] 0x0000002b mov dword ptr fs:[00000000h], esp 0x00000032 push esi 0x00000033 jg 00007FAD6853650Ch 0x00000039 pop ebx 0x0000003a mov eax, dword ptr [ebp+13A815A9h] 0x00000040 mov dword ptr [ebp+13A820C9h], edi 0x00000046 push FFFFFFFFh 0x00000048 push 00000000h 0x0000004a push eax 0x0000004b call 00007FAD68536508h 0x00000050 pop eax 0x00000051 mov dword ptr [esp+04h], eax 0x00000055 add dword ptr [esp+04h], 0000001Ch 0x0000005d inc eax 0x0000005e push eax 0x0000005f ret 0x00000060 pop eax 0x00000061 ret 0x00000062 or bh, FFFFFFD8h 0x00000065 nop 0x00000066 ja 00007FAD6853650Ah 0x0000006c push eax 0x0000006d push eax 0x0000006e push edx 0x0000006f jc 00007FAD6853650Ch 0x00000075 jnl 00007FAD68536506h 0x0000007b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8BEA second address: 9C8C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 nop 0x00000008 push 00000000h 0x0000000a push esi 0x0000000b call 00007FAD6938CD18h 0x00000010 pop esi 0x00000011 mov dword ptr [esp+04h], esi 0x00000015 add dword ptr [esp+04h], 0000001Dh 0x0000001d inc esi 0x0000001e push esi 0x0000001f ret 0x00000020 pop esi 0x00000021 ret 0x00000022 push 00000000h 0x00000024 mov edi, dword ptr [ebp+13BF7BA1h] 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push ecx 0x0000002f call 00007FAD6938CD18h 0x00000034 pop ecx 0x00000035 mov dword ptr [esp+04h], ecx 0x00000039 add dword ptr [esp+04h], 0000001Dh 0x00000041 inc ecx 0x00000042 push ecx 0x00000043 ret 0x00000044 pop ecx 0x00000045 ret 0x00000046 call 00007FAD6938CD1Ah 0x0000004b sbb bx, 7FF1h 0x00000050 pop ebx 0x00000051 xchg eax, esi 0x00000052 push ebx 0x00000053 pushad 0x00000054 jg 00007FAD6938CD16h 0x0000005a push eax 0x0000005b push edx 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8E93 second address: 9C8E97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C8E97 second address: 9C8E9B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9C9E42 second address: 9C9E48 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CBC30 second address: 9CBCA2 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov dword ptr [esp], eax 0x0000000a push 00000000h 0x0000000c push edi 0x0000000d call 00007FAD6938CD18h 0x00000012 pop edi 0x00000013 mov dword ptr [esp+04h], edi 0x00000017 add dword ptr [esp+04h], 00000019h 0x0000001f inc edi 0x00000020 push edi 0x00000021 ret 0x00000022 pop edi 0x00000023 ret 0x00000024 push 00000000h 0x00000026 push 00000000h 0x00000028 push ecx 0x00000029 call 00007FAD6938CD18h 0x0000002e pop ecx 0x0000002f mov dword ptr [esp+04h], ecx 0x00000033 add dword ptr [esp+04h], 00000018h 0x0000003b inc ecx 0x0000003c push ecx 0x0000003d ret 0x0000003e pop ecx 0x0000003f ret 0x00000040 mov bl, 5Eh 0x00000042 push 00000000h 0x00000044 jmp 00007FAD6938CD27h 0x00000049 push eax 0x0000004a jl 00007FAD6938CD20h 0x00000050 pushad 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CEB89 second address: 9CEB9D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536510h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFBB7 second address: 9CFC2B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jp 00007FAD6938CD16h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 call 00007FAD6938CD29h 0x00000016 jmp 00007FAD6938CD1Ch 0x0000001b pop ebx 0x0000001c push 00000000h 0x0000001e mov bl, 61h 0x00000020 push 00000000h 0x00000022 push 00000000h 0x00000024 push ebx 0x00000025 call 00007FAD6938CD18h 0x0000002a pop ebx 0x0000002b mov dword ptr [esp+04h], ebx 0x0000002f add dword ptr [esp+04h], 00000016h 0x00000037 inc ebx 0x00000038 push ebx 0x00000039 ret 0x0000003a pop ebx 0x0000003b ret 0x0000003c sub dword ptr [ebp+13A82D0Fh], ecx 0x00000042 xchg eax, esi 0x00000043 push eax 0x00000044 push edx 0x00000045 push eax 0x00000046 push edx 0x00000047 jmp 00007FAD6938CD1Eh 0x0000004c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFC2B second address: 9CFC2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFC2F second address: 9CFC35 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFC35 second address: 9CFC45 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e push esi 0x0000000f pop esi 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9CFD92 second address: 9CFE1F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FAD6938CD16h 0x00000009 jnl 00007FAD6938CD16h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 pushad 0x00000016 cld 0x00000017 popad 0x00000018 push dword ptr fs:[00000000h] 0x0000001f mov dword ptr [ebp+13BF8E1Dh], eax 0x00000025 mov dword ptr fs:[00000000h], esp 0x0000002c push 00000000h 0x0000002e push eax 0x0000002f call 00007FAD6938CD18h 0x00000034 pop eax 0x00000035 mov dword ptr [esp+04h], eax 0x00000039 add dword ptr [esp+04h], 0000001Bh 0x00000041 inc eax 0x00000042 push eax 0x00000043 ret 0x00000044 pop eax 0x00000045 ret 0x00000046 mov di, ADB6h 0x0000004a mov eax, dword ptr [ebp+13A80029h] 0x00000050 mov dword ptr [ebp+13A83066h], ebx 0x00000056 push FFFFFFFFh 0x00000058 js 00007FAD6938CD1Ch 0x0000005e mov edi, dword ptr [ebp+13A832DAh] 0x00000064 nop 0x00000065 jbe 00007FAD6938CD24h 0x0000006b jmp 00007FAD6938CD1Eh 0x00000070 push eax 0x00000071 push eax 0x00000072 push edx 0x00000073 jno 00007FAD6938CD18h 0x00000079 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AF3 second address: 9D1AF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1AF7 second address: 9D1B01 instructions: 0x00000000 rdtsc 0x00000002 ja 00007FAD6938CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B01 second address: 9D1B3D instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edi 0x00000004 pop edi 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 nop 0x00000009 movzx ebx, di 0x0000000c push 00000000h 0x0000000e push 00000000h 0x00000010 push edx 0x00000011 call 00007FAD68536508h 0x00000016 pop edx 0x00000017 mov dword ptr [esp+04h], edx 0x0000001b add dword ptr [esp+04h], 00000017h 0x00000023 inc edx 0x00000024 push edx 0x00000025 ret 0x00000026 pop edx 0x00000027 ret 0x00000028 push 00000000h 0x0000002a mov dword ptr [ebp+13A8391Dh], edx 0x00000030 xchg eax, esi 0x00000031 push eax 0x00000032 push edx 0x00000033 push eax 0x00000034 push edx 0x00000035 pop edx 0x00000036 pop eax 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1B3D second address: 9D1B43 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D2A8C second address: 9D2A99 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007FAD68536506h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D1C8B second address: 9D1C92 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D3CA3 second address: 9D3CAD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007FAD68536506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D769A second address: 9D76BD instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD29h 0x00000007 jg 00007FAD6938CD16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D76BD second address: 9D76C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9D76C3 second address: 9D76CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007FAD6938CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9E5DC5 second address: 9E5DCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED9CB second address: 9ED9F6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 ja 00007FAD6938CD16h 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnl 00007FAD6938CD2Ch 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9ED9F6 second address: 9EDA36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007FAD68536506h 0x00000009 jmp 00007FAD68536516h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 mov eax, dword ptr [esp+04h] 0x00000015 jmp 00007FAD68536512h 0x0000001a mov eax, dword ptr [eax] 0x0000001c push eax 0x0000001d push edx 0x0000001e push ebx 0x0000001f push ebx 0x00000020 pop ebx 0x00000021 pop ebx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDA36 second address: 9EDA41 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 ja 00007FAD6938CD16h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9EDA41 second address: 9EDA67 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b je 00007FAD68536521h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007FAD68536513h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F26BC second address: 9F26C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F26C0 second address: 9F26DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jno 00007FAD68536508h 0x0000000c pop esi 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 js 00007FAD68536506h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F26DB second address: 9F26E1 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F26E1 second address: 9F26E6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1BEB second address: 9F1BF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1BF1 second address: 9F1BF5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1BF5 second address: 9F1BFB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D5B second address: 9F1D5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F1D5F second address: 9F1D6C instructions: 0x00000000 rdtsc 0x00000002 js 00007FAD6938CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F2179 second address: 9F21A6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007FAD6853650Ah 0x0000000b push eax 0x0000000c pop eax 0x0000000d popad 0x0000000e pushad 0x0000000f push eax 0x00000010 pop eax 0x00000011 jmp 00007FAD68536516h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FAB5C second address: 9FABA9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a pushad 0x0000000b pushad 0x0000000c push edx 0x0000000d pop edx 0x0000000e jmp 00007FAD6938CD1Fh 0x00000013 push ecx 0x00000014 pop ecx 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007FAD6938CD16h 0x0000001e jmp 00007FAD6938CD24h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9455 second address: 9F945B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F945B second address: 9F945F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9729 second address: 9F972F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F972F second address: 9F9733 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9733 second address: 9F975E instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e je 00007FAD6853651Dh 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F98D9 second address: 9F98F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6938CD23h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F98F1 second address: 9F990E instructions: 0x00000000 rdtsc 0x00000002 jno 00007FAD6853650Eh 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push edi 0x0000000c pop edi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F990E second address: 9F9916 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9916 second address: 9F993C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 js 00007FAD68536521h 0x0000000b jmp 00007FAD68536515h 0x00000010 jnp 00007FAD68536506h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9AA4 second address: 9F9AA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9AA9 second address: 9F9ABC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push ebx 0x0000000b jnl 00007FAD68536506h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9ABC second address: 9F9AC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9AC4 second address: 9F9AF4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD68536511h 0x00000009 je 00007FAD68536506h 0x0000000f jmp 00007FAD6853650Ah 0x00000014 popad 0x00000015 ja 00007FAD6853650Eh 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9F9EE0 second address: 9F9EFB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jns 00007FAD6938CD1Ch 0x0000000b popad 0x0000000c pushad 0x0000000d push ebx 0x0000000e push ebx 0x0000000f pop ebx 0x00000010 pop ebx 0x00000011 push eax 0x00000012 push edx 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EFA2 second address: 99EFAE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push edi 0x00000007 pop edi 0x00000008 pop esi 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 99EFAE second address: 99EFB6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA97E second address: 9FA984 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FA984 second address: 9FA996 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD6938CD1Ch 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF038 second address: 9FF06C instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD68536506h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jo 00007FAD68536508h 0x00000012 pushad 0x00000013 popad 0x00000014 pop ecx 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 jo 00007FAD68536506h 0x0000001e pushad 0x0000001f popad 0x00000020 push eax 0x00000021 pop eax 0x00000022 pushad 0x00000023 popad 0x00000024 popad 0x00000025 push eax 0x00000026 jmp 00007FAD6853650Ch 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF06C second address: 9FF071 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF071 second address: 9FF07B instructions: 0x00000000 rdtsc 0x00000002 je 00007FAD6853650Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF2FB second address: 9FF302 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF302 second address: 9FF30C instructions: 0x00000000 rdtsc 0x00000002 js 00007FAD68536520h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF30C second address: 9FF327 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6938CD24h 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FF5EC second address: 9FF5F1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FED88 second address: 9FED92 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD6938CD16h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFA89 second address: 9FFA8D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFBD6 second address: 9FFBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFBDE second address: 9FFBE4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFBE4 second address: 9FFC07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007FAD6938CD29h 0x0000000b popad 0x0000000c push ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFC07 second address: 9FFC0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD63 second address: 9FFD67 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD67 second address: 9FFD6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD6D second address: 9FFD93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 js 00007FAD6938CD16h 0x00000009 jmp 00007FAD6938CD28h 0x0000000e popad 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9FFD93 second address: 9FFD97 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A000A3 second address: A000A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04270 second address: A04274 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04274 second address: A04278 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8F22 second address: 9B8F26 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8F26 second address: 9B8F40 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD26h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8F40 second address: 9B8F5A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD68536516h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8FCA second address: 9B8FD0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B8FD0 second address: 9B9009 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov dword ptr [esp], esi 0x0000000b mov edi, dword ptr [ebp+13A82DD1h] 0x00000011 nop 0x00000012 push edi 0x00000013 push ebx 0x00000014 jmp 00007FAD68536519h 0x00000019 pop ebx 0x0000001a pop edi 0x0000001b push eax 0x0000001c push edx 0x0000001d push eax 0x0000001e push edx 0x0000001f jnl 00007FAD68536506h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9009 second address: 9B900D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9332 second address: 9B933C instructions: 0x00000000 rdtsc 0x00000002 jc 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9992 second address: 9B9997 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B9997 second address: 9B99E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jno 00007FAD6853651Bh 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jmp 00007FAD68536514h 0x00000017 mov eax, dword ptr [eax] 0x00000019 pushad 0x0000001a pushad 0x0000001b jmp 00007FAD6853650Ah 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99E2 second address: 9B99EF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jno 00007FAD6938CD16h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B99EF second address: 9B9A06 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007FAD6853650Ah 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04691 second address: A0469B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007FAD6938CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0495B second address: A0498B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAD6853650Dh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b jmp 00007FAD68536516h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 push ecx 0x00000016 pop ecx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0498B second address: A049A6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD27h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04F13 second address: A04F26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD6853650Eh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04F26 second address: A04F2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A04F2C second address: A04F51 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAD6853650Fh 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jp 00007FAD68536508h 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 popad 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B6CB second address: A0B6E2 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push edx 0x00000004 pop edx 0x00000005 jl 00007FAD6938CD16h 0x0000000b pop esi 0x0000000c pop edx 0x0000000d pop eax 0x0000000e jng 00007FAD6938CD3Eh 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B41D second address: A0B421 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B421 second address: A0B427 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B427 second address: A0B431 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0B431 second address: A0B435 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E5BD second address: A0E5EB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536519h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007FAD6853650Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E5EB second address: A0E612 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jmp 00007FAD6938CD27h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f jl 00007FAD6938CD16h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E612 second address: A0E616 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0DEC3 second address: A0DEF7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6938CD29h 0x00000009 pop esi 0x0000000a jmp 00007FAD6938CD26h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A0E2FB second address: A0E301 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13D6C second address: A13D70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13013 second address: A13029 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnp 00007FAD68536506h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FAD68536508h 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13029 second address: A13037 instructions: 0x00000000 rdtsc 0x00000002 jp 00007FAD6938CD18h 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13037 second address: A13041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007FAD68536506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1318E second address: A13194 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A13194 second address: A131A9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD6853650Bh 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A131A9 second address: A131AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A131AD second address: A131EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6853650Eh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b popad 0x0000000c pushad 0x0000000d jmp 00007FAD6853650Dh 0x00000012 jo 00007FAD68536519h 0x00000018 push eax 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1345D second address: A1347F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 pushad 0x00000006 jmp 00007FAD6938CD28h 0x0000000b pushad 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A135C4 second address: A135C8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A135C8 second address: A135D6 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007FAD6938CD32h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A138AF second address: A138C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 popad 0x00000009 jmp 00007FAD68536511h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A138C9 second address: A138CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17F6C second address: A17F70 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A17F70 second address: A17F9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007FAD6938CD1Dh 0x0000000b pop ecx 0x0000000c push eax 0x0000000d push edx 0x0000000e jp 00007FAD6938CD24h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1828D second address: A18291 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18291 second address: A182B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAD6938CD16h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c popad 0x0000000d push eax 0x0000000e pushad 0x0000000f jmp 00007FAD6938CD1Ah 0x00000014 push ebx 0x00000015 pop ebx 0x00000016 pushad 0x00000017 popad 0x00000018 popad 0x00000019 push eax 0x0000001a push edx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A182B3 second address: A182B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A182B7 second address: A182BB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A183FC second address: A18402 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A18402 second address: A1840C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1840C second address: A18422 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 js 00007FAD68536506h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jg 00007FAD68536506h 0x00000014 push edx 0x00000015 pop edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B96A8 second address: 9B96AC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9B96AC second address: 9B96BC instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A188E0 second address: A188E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A188E6 second address: A188EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A188EA second address: A1890A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push esi 0x00000008 pushad 0x00000009 push ebx 0x0000000a pop ebx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FAD6938CD1Fh 0x00000012 popad 0x00000013 push eax 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BCE1 second address: A1BCE9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BCE9 second address: A1BCED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A1BCED second address: A1BD0F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536516h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007FAD68536506h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23301 second address: A23346 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD28h 0x00000007 jns 00007FAD6938CD16h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jmp 00007FAD6938CD22h 0x00000014 pushad 0x00000015 jmp 00007FAD6938CD1Eh 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23346 second address: A23358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 pushad 0x00000007 push edx 0x00000008 jc 00007FAD68536506h 0x0000000e pop edx 0x0000000f push edi 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2366E second address: A23674 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23674 second address: A23683 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jc 00007FAD68536506h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A23683 second address: A23689 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D51 second address: A27D58 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D58 second address: A27D76 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007FAD6938CD29h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27D76 second address: A27D7C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26F61 second address: A26F66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A26F66 second address: A26F72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jg 00007FAD68536506h 0x0000000a push eax 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A270BF second address: A270CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnl 00007FAD6938CD16h 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A270CF second address: A270D5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A270D5 second address: A270FF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jnl 00007FAD6938CD18h 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FAD6938CD28h 0x00000012 popad 0x00000013 push edx 0x00000014 push ebx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27246 second address: A2725E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pop ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007FAD6853650Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A2725E second address: A27273 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD6938CD21h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27685 second address: A27698 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 ja 00007FAD6853650Eh 0x0000000b jo 00007FAD68536506h 0x00000011 push edi 0x00000012 pop edi 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27951 second address: A27956 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A27AB0 second address: A27AD2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536517h 0x00000007 pushad 0x00000008 jnl 00007FAD68536506h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31EFC second address: A31F06 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007FAD6938CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A31F06 second address: A31F0A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32066 second address: A320B0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD22h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007FAD6938CD3Eh 0x0000000f jmp 00007FAD6938CD28h 0x00000014 jmp 00007FAD6938CD20h 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320B0 second address: A320B4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320B4 second address: A320C0 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320C0 second address: A320C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320C4 second address: A320CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A320CE second address: A320DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD6853650Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32651 second address: A32667 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD1Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32667 second address: A32681 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD68536516h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32681 second address: A32687 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32687 second address: A3268E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32BD1 second address: A32BD7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A32BD7 second address: A32BDD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B18C second address: A3B1C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD20h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAD6938CD24h 0x00000010 jmp 00007FAD6938CD1Ah 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3B1C0 second address: A3B1C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3ABCE second address: A3ABD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3ABD2 second address: A3ABDC instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3ABDC second address: A3ABE2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A3AE9F second address: A3AEA7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 973458 second address: 97347B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAD6938CD16h 0x0000000a jmp 00007FAD6938CD21h 0x0000000f je 00007FAD6938CD1Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A46668 second address: A4666E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A467AF second address: A467B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A467B5 second address: A467BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A467BB second address: A467C5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007FAD6938CD16h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A467C5 second address: A467C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4942D second address: A49441 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 pushad 0x00000007 popad 0x00000008 jmp 00007FAD6938CD1Bh 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48FCC second address: A48FE8 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007FAD68536512h 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48FE8 second address: A48FEC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A48FEC second address: A48FF0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B9D9 second address: A4B9DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4B9DE second address: A4BA1B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnl 00007FAD68536506h 0x00000009 jmp 00007FAD68536511h 0x0000000e pushad 0x0000000f popad 0x00000010 jbe 00007FAD68536506h 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 pushad 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007FAD68536513h 0x00000021 push ecx 0x00000022 pop ecx 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA1B second address: A4BA2D instructions: 0x00000000 rdtsc 0x00000002 jl 00007FAD6938CD16h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jng 00007FAD6938CD1Ch 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4BA2D second address: A4BA36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A4F523 second address: A4F527 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53B16 second address: A53B1B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53B1B second address: A53B21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53B21 second address: A53B25 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A53B25 second address: A53B5B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD26h 0x00000007 jmp 00007FAD6938CD1Eh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f jmp 00007FAD6938CD1Bh 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A525C8 second address: A525D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 ja 00007FAD68536506h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A525D2 second address: A525D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A6703B second address: A67053 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FAD68536513h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65A2D second address: A65A31 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65A31 second address: A65A49 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007FAD6853650Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A65F95 second address: A65FC2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007FAD6938CD29h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007FAD6938CD1Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66159 second address: A66167 instructions: 0x00000000 rdtsc 0x00000002 jg 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d pop esi 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A66D70 second address: A66D74 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69DEE second address: A69E0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007FAD68536510h 0x00000009 pushad 0x0000000a popad 0x0000000b popad 0x0000000c pop ecx 0x0000000d push eax 0x0000000e push edx 0x0000000f push ebx 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69E0D second address: A69E1C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 jmp 00007FAD6938CD1Ah 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69ACF second address: A69ADB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop ebx 0x00000006 pushad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A69ADB second address: A69B04 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 pop eax 0x00000008 popad 0x00000009 pushad 0x0000000a je 00007FAD6938CD16h 0x00000010 jmp 00007FAD6938CD21h 0x00000015 push ebx 0x00000016 pop ebx 0x00000017 pushad 0x00000018 popad 0x00000019 popad 0x0000001a push ebx 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B32 second address: A72B36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B36 second address: A72B49 instructions: 0x00000000 rdtsc 0x00000002 je 00007FAD6938CD16h 0x00000008 jnc 00007FAD6938CD16h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push ecx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B49 second address: A72B59 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007FAD68536506h 0x0000000a pop ecx 0x0000000b pushad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A72B59 second address: A72B5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75DC0 second address: A75DC7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75DC7 second address: A75DD4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75DD4 second address: A75DE2 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75BDA second address: A75BE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75BE0 second address: A75C47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007FAD68536518h 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d jmp 00007FAD6853650Eh 0x00000012 pop edx 0x00000013 push esi 0x00000014 pushad 0x00000015 popad 0x00000016 pop esi 0x00000017 popad 0x00000018 push eax 0x00000019 push edx 0x0000001a pushad 0x0000001b jnp 00007FAD68536506h 0x00000021 jmp 00007FAD68536515h 0x00000026 push edx 0x00000027 pop edx 0x00000028 popad 0x00000029 jmp 00007FAD68536512h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A75C47 second address: A75C5D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jmp 00007FAD6938CD1Ch 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A844B1 second address: A844C4 instructions: 0x00000000 rdtsc 0x00000002 jnc 00007FAD68536506h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edx 0x0000000c pop edx 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8B1AC second address: A8B1B0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8BB1C second address: A8BB39 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop eax 0x00000007 push ebx 0x00000008 jmp 00007FAD68536513h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EFC4 second address: A8EFE0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007FAD6938CD16h 0x0000000a jmp 00007FAD6938CD1Fh 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8EA5F second address: A8EA63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A92D87 second address: A92D92 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007FAD6938CD16h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FF8F second address: A8FF93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FF93 second address: A8FFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 pop eax 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007FAD6938CD28h 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8FFB7 second address: A8FFBD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8ED21 second address: A8ED38 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 jmp 00007FAD6938CD22h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: A8ED38 second address: A8ED4D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jnl 00007FAD68536506h 0x00000009 pushad 0x0000000a popad 0x0000000b pop edi 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f push ebx 0x00000010 pop ebx 0x00000011 pushad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCCE7 second address: 9BCCED instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 9BCCED second address: 9BCCFC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007FAD6853650Bh 0x00000009 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 811A15 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 9D9F2E instructions caused by: Self-modifying code

Source: C:\Users\user\Desktop\file.exe	Memory allocated: 51B0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 5390000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Memory allocated: 51B0000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 4314			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window / User API: threadDelayed 5507			Jump to behavior

Source: C:\Users\user\Desktop\file.exe TID: 7776	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7788	Thread sleep count: 4314 > 30	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 7788	Thread sleep count: 5507 > 30	Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: file.exe, file.exe, 00000000.00000002.3032574616.0000000000990000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Amcache.hve.9.dr	Binary or memory string: VMware
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.9.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.9.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.9.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.9.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.9.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: vmci.sys
Source: file.exe, 00000000.00000002.3033379354.000000000144B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll9
Source: Amcache.hve.9.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.9.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.9.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.9.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.9.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.9.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.9.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.9.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.9.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.9.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.9.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.9.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: file.exe, 00000000.00000002.3032574616.0000000000990000.00000040.00000001.01000000.00000003.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Amcache.hve.9.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe

Thread information set: HideFromDebugger

Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\Desktop\file.exe	Open window title or class name: regmonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: ollydbg
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: filemonclass
Source: C:\Users\user\Desktop\file.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\Desktop\file.exe	File opened: NTICE
Source: C:\Users\user\Desktop\file.exe	File opened: SICE
Source: C:\Users\user\Desktop\file.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"

Jump to behavior

Source: file.exe, 00000000.00000002.3035777047.00000000053E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000053CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>1997436
Source: file.exe, file.exe, 00000000.00000002.3035777047.000000000547D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054FE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: file.exe, 00000000.00000002.3035777047.000000000547D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054FE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000053E7000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Managert-^q
Source: file.exe, 00000000.00000002.3035777047.000000000547D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q'PING!<Xwormmm>Program Manager<Xwormmm>0Te^qL
Source: file.exe, 00000000.00000002.3035777047.000000000547D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054FE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\^q@\^q'PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.3035777047.00000000053E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000053CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: @\^q@\^q-PING!<Xwormmm>Program Manager<Xwormmm>1997436
Source: file.exe, 00000000.00000002.3035777047.000000000547D000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054FE000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000054A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: PING!<Xwormmm>Program Manager<Xwormmm>0
Source: file.exe, 00000000.00000002.3035777047.00000000054A4000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q'PING!<Xwormmm>Program Manager<Xwormmm>0Te^qhPJ
Source: file.exe, 00000000.00000002.3035777047.00000000053E7000.00000004.00000800.00020000.00000000.sdmp, file.exe, 00000000.00000002.3035777047.00000000053CA000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q-PING!<Xwormmm>Program Manager<Xwormmm>1997436Te^q
Source: file.exe, 00000000.00000002.3035777047.00000000054FE000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: $^q'PING!<Xwormmm>Program Manager<Xwormmm>0Te^q$

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: Amcache.hve.9.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.9.dr	Binary or memory string: MsMpEng.exe

Source: C:\Users\user\Desktop\file.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 0.2.file.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7528, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 0.2.file.exe.800000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 7528, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 Scheduled Task/Job	12 Process Injection	1 Masquerading	OS Credential Dumping	751 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	2 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	1 DLL Side-Loading	2 Registry Run Keys / Startup Folder	361 Virtualization/Sandbox Evasion	Security Account Manager	361 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	12 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	12 Software Packing	Cached Domain Credentials	214 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	32%	ReversingLabs
file.exe	100%	Avira	HEUR/AGEN.1313526
file.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
179.43.171.209	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
179.43.171.209	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://upx.sf.net	Amcache.hve.9.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	file.exe, 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
179.43.171.209	unknown	Panama		51852	PLI-ASCH	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1565730
Start date and time:	2024-11-30 17:19:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 59s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@5/6@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.42.73.29
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdeus15.eastus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:19:54	API Interceptor	2715057x Sleep call for process: file.exe modified
11:22:11	API Interceptor	1x Sleep call for process: WerFault.exe modified
16:19:56	Task Scheduler	Run new task: github path: C:\Users\user\AppData\Roaming\github.exe
16:19:59	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
179.43.171.209	file.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
PLI-ASCH	file.exe	Get hash	malicious	XWorm	Browse	179.43.171.209
	H4IoDDh3Rv.exe	Get hash	malicious	AveMaria, PrivateLoader, UACMe	Browse	176.223.112.134
	wE1inOhJA5.msi	Get hash	malicious	Remcos, RHADAMANTHYS	Browse	179.43.171.197
	o4QEzeCniw.exe	Get hash	malicious	Unknown	Browse	179.43.182.252
	http://software.oldversion.com/download.php?f=YTo1OntzOjQ6InRpbWUiO2k6MTczMTQ4OTAwMjtzOjI6ImlkIjtpOjEzODk4O3M6NDoiZmlsZSI7czo0MzoicGRmY3JlYXRvci0xLTYtMi1QREZDcmVhdG9yLTFfNl8yX3NldHVwLmV4ZSI7czozOiJ1cmwiO3M6NTA6Imh0dHA6Ly93d3cub2xkdmVyc2lvbi5jb20vd2luZG93cy9wZGZjcmVhdG9yLTEtNi0yIjtzOjQ6InBhc3MiO3M6MzI6IjMwYzExNzY3MTEwNWY3MjhjYjA0YzU2ZjkzYTc1YTRjIjt9	Get hash	malicious	Unknown	Browse	81.17.20.50
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Exploit Detector LIST (2).bat	Get hash	malicious	Unknown	Browse	179.43.180.122
	Payload 94.75 (3).225.exe	Get hash	malicious	Unknown	Browse	190.211.254.101
	Payload 94.75.225.exe	Get hash	malicious	Unknown	Browse	190.211.254.192
	file.exe	Get hash	malicious	WhiteSnake Stealer	Browse	81.17.25.195

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_e03c1446a791a6774320993325b3bfe7a93ee1_8bc8969b_23543bc7-22dc-4eef-847c-da056f5b3b50\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.287231271048851
Encrypted:	false
SSDEEP:	192:h7xXBpZvlsyOf0BU/fI3juavt8CHzozuiFqZ24IO8HVB:9HPemBU/Yj9+i8zuiFqY4IO87
MD5:	7F052F60F822A68E76607F33E4FEF5E9
SHA1:	09AAE9D84378C720BDD1B8CC6DB3891C2AC85234
SHA-256:	D70B1B9E930D6172B6FE18438D44F057F47F4E74710B2D7035DB2492B868CF17
SHA-512:	772077CAB1E436AB85D802830D7690EFFC78717AB653CBA6D9CD74314E0A2B386C82F039FB25D66A711B6D40D13774980937B5035C1B2F84DFAEF43D8E8C3EB1
Malicious:	true
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.C.L.R.2.0.r.3.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.7.4.5.7.3.0.4.2.2.4.6.1.5.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.7.4.5.7.3.0.5.5.0.5.8.6.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.3.5.4.3.b.c.7.-.2.2.d.c.-.4.e.e.f.-.8.4.7.c.-.d.a.0.5.6.f.5.b.3.b.5.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.6.4.8.b.7.e.d.-.d.2.5.0.-.4.9.8.9.-.b.d.7.8.-.5.9.5.d.3.c.2.8.e.f.1.5.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.f.i.l.e...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.g.i.t.h.u.b...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.6.8.-.0.0.0.1.-.0.0.1.4.-.4.1.6.d.-.3.0.b.0.4.3.4.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.d.b.1.f.5.e.c.8.4.6.3.4.e.a.0.3.a.7.9.a.6.5.e.9.8.c.e.4.7.d.0.a.0.0.0.0.0.0.0.0.!.0.0.0.0.9.6.b.5.8.d.8.9.d.d.f.e.d.d.a.3.d.c.8.d.a.e.b.b.4.3.9.1.a.b.e.4.0.8.4.3.2.5.3.e.!.f.i.l.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1AB.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Sat Nov 30 16:21:44 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	514162
Entropy (8bit):	2.761887453438018
Encrypted:	false
SSDEEP:	3072:Y6gYfZh78I4uEq2EELTgkt/7yYrT2xTM0NBTr:rPP8I4lE6TgS/7yYri
MD5:	1ADFD95264F08C0814120AFADD0042DA
SHA1:	7E056964E5D5D3BDE68FBFD170812BD37D2FEA90
SHA-256:	D3738C75C5973AA1A03E3E0F08AE5F5E8C3ADC7AC526D411BB10EF9534AF9020
SHA-512:	159F0386A6FD4441804BD596E3A431BE9EE8D85BC4B65DEB7727CCDE631C88B19E1148862EB9CF9C2F34C9C5F22EFCEBD786A252C68DEFC9F304124704ECE7EE
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........;Kg............D...........$%..L.......$+.............T.......8...........T...........HY..*...........p4..........\6..............................................................................eJ.......6......GenuineIntel............T.......h...);Kg....1........................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5C3.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8390
Entropy (8bit):	3.6911639209534237
Encrypted:	false
SSDEEP:	192:R6l7wVeJ4CH6vOwe6Y9kSUd+zgmfZDR2prl89bH4jsfaVlOm:R6lXJP6v46Y+SUd+zgmf7pH4Ifa/X
MD5:	DF8621B40975DAE735DAF9838AAA7064
SHA1:	4393D7C94260278D79B4821FAED5065789FBCB78
SHA-256:	9CCE4A67E7DB76C5634AC6A0F423F52A6B2EC5220D30198830B5197F95566E35
SHA-512:	F59AF4F8705AC55FAC3DD7C255D01215A892C529BD6A1C188F8150AF974CE53E1C28A0A1B385C383741A4EDE590FE1EC823AEE8E8883DD48EC172D4519E02873
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.2.8.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5F3.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4710
Entropy (8bit):	4.434149525201229
Encrypted:	false
SSDEEP:	48:cvIwWl8zsZ4Jg77aI94zWpW8VY/Ym8M4JR6xFV+q8vN6GKyGeTNd:uIjfwI7aC7VzJ4ZKEGKleTNd
MD5:	7D0D91C323C8BE71AF57C7B2481E342A
SHA1:	1C78F64AED70F4C932798C76DDDAEFBDFD237022
SHA-256:	4186A6C11FC87870646DF63718E17D9B11142FE2E9E360C45D7DA07717A85D72
SHA-512:	E7A16E43D032B12FA583C8B812E0D8069BAF26EBFE0D45AF85C8536541FC8486C38A64404C49FCBFF4A4D7C09B0B4743A324DF18928308296C765420DB7FE1D6
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="611004" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, ctime=Sun Dec 31 23:25:52 1600, mtime=Sun Dec 31 23:25:52 1600, atime=Sun Dec 31 23:25:52 1600, length=0, window=hide
Category:	dropped
Size (bytes):	806
Entropy (8bit):	3.0313025183053437
Encrypted:	false
SSDEEP:	12:8gl0hsXowAOcQ/tz0/CSLS0KvEAIeEAwgTCNfBT/v4t2YZ/elFlSJm:8iLDWL2vLXLwVpdqy
MD5:	62E1588ED39BC434699F221C98E7F416
SHA1:	2453CC7C2512ACA85F49AEF138F12C4CA77E9E1E
SHA-256:	F05794F6003167AE87863074F82A3CB39087CA01617FD4F95E2A22BF9AD5D459
SHA-512:	6EFF872D3DA31495A3FCA14FF64C18018691CCD3180B7BBD4FF505247787A42B96FE33F2197AFB40F6D7A54ABAF644334843504C9DD0FD182CB9CCA3C9FEEBA6
Malicious:	false
Reputation:	low
Preview:	L..................F.............................................................P.O. .:i.....+00.../C:\...................P.1...........Users.<............................................U.s.e.r.s.....P.1...........user.<............................................j.o.n.e.s.....V.1...........AppData.@............................................A.p.p.D.a.t.a.....V.1...........Roaming.@............................................R.o.a.m.i.n.g.....`.2...........github.exe..F............................................g.i.t.h.u.b...e.x.e.............\.....\.....\.....\.....\.g.i.t.h.u.b...e.x.e.............y.............>.e.L.:..er.=y...............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.2.................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.465471114235031
Encrypted:	false
SSDEEP:	6144:LIXfpi67eLPU9skLmb0b4bWSPKaJG8nAgejZMMhA2gX4WABl0uNPdwBCswSby:MXD94bWlLZMM6YFH1+y
MD5:	C7C8F5DF9FD6FEE76D89F33550F851AF
SHA1:	BBE95A9A2889290D45B58986929BAE7AAF5AA498
SHA-256:	A93A933615146DD3A0FD4A2373AC000D26990027BA60E2C4DBBB4FECEF69B83F
SHA-512:	6E8BA170DB9DF73EFD5ADCE4A1C8BE495689B72E130956E5D185BC966A58538975AF3DC076899D70AF363D2A9D046763FD5866AFA9EB97DBE000CD0F803B7E76
Malicious:	false
Reputation:	low
Preview:	regf6...6....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmJs..CC..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.9350018891587055
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'723'904 bytes
MD5:	7ac5198e128deda55eeeb6ccfc8b57ea
SHA1:	96b58d89ddfedda3dc8daebb4391abe40843253e
SHA256:	887a2e09a1e373ad3f5224a8464b0e5b4ebe4a344958c2d9c91cbd42a54f1241
SHA512:	806e4cbf2b47aff1e0bfb89fa13d55d10290c4cabb97e675808f3dbdcb7633d8fd97fc10619efd1c0ee8d11a0c15c0604ccfc32d9a60979542a5235087127818
SSDEEP:	49152:KQ4SuBDQC/lhGT3uXQqxxi0se9ZqMUO7kF:2S8QilVXBwgq
TLSH:	7B8533421A25B076C4B99AFF1346C3B0889972D19162A73BBEC9772C9B435DD73C2CE1
File Content Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...r0Kg.................~........... D.. ........@.. .......................`D...........@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x842000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE
Time Stamp:	0x674B3072 [Sat Nov 30 15:34:10 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007FAD68512A6Ah
cvttps2pi mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [eax], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx], ah
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [esi], al
or al, byte ptr [eax]
add byte ptr [ecx], al
or al, byte ptr [eax]
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [eax+00000000h], eax
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add eax, 0000000Ah
add byte ptr [eax], al
add byte ptr [eax], dh
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [edi], bl
add byte ptr [eax+000000FEh], ah

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xc055	0x69	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xa000	0x438	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xc1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x2000	0x8000	0x4000	55c153089f9a7a78462ab56439b612f1	False	0.98553466796875	data	7.928832262074926	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0xa000	0x438	0x400	99ed269b050e92fb505662e7e6fedeb3	False	0.5791015625	data	4.924615289563029	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xc000	0x2000	0x200	ef799d04f0bcc64d595195637d8ea585	False	0.1484375	data	0.9342685949460681	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0xe000	0x296000	0x200	3262c01ac9917ea82b264fa0ea117009	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
dvpnmyli	0x2a4000	0x19c000	0x19c000	8d6c99c8db547d9cd0564b159d05143f	False	0.9949074161862864	data	7.95384464177905	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
lhlewnhz	0x440000	0x2000	0x400	684b11b2f8e2f5387216d33c1e1e4b6a	False	0.7861328125	data	6.145502119326234	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x442000	0x4000	0x2200	de3ab96900c192c50dee7304fb69fbea	False	0.06364889705882353	DOS executable (COM)	0.795610140776652	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x43fc3c	0x244	data			0.4706896551724138
RT_MANIFEST	0x43fe80	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-30T17:20:08.583016+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:09.010710+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:09.245403+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:19.643363+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:19.645453+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:22.214594+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:22.214594+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:30.299793+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:30.302783+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:40.975938+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:40.977605+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:51.611824+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:51.614357+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:52.221493+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:52.221493+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.300061+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.390071+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.501283+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.510176+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.702545+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.801462+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:57.836221+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:57.921504+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:58.523684+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:58.614643+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:58.726283+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:58.846503+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:58.927385+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.175390+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.253649+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.429051+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.500582+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.826371+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:20:59.872423+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:20:59.992727+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.220954+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.234009+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.496387+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.572970+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.616370+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.684049+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.771455+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:00.817675+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:00.949361+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:01.674936+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:01.705483+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:01.876034+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:01.917490+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.026735+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.039160+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.150407+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.163768+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.475069+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.518922+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.716808+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:02.765160+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:02.798538+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.004746+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.008842+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.280556+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.283530+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.452108+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.525261+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.525609+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.606363+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:03.609512+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:03.939473+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.082277+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.202510+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:04.835903+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:04.838588+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:05.283334+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.284859+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:05.587885+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.788977+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:05.822962+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.002525+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.129911+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.144230+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.248777+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.248891+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.311705+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:06.470566+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:06.471938+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:07.157688+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:07.160354+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:07.358637+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:07.366014+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.122943+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.308332+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.364889+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.365000+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.391474+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.432265+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.485097+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:08.676654+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:08.878075+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.208438+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.209974+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.350039+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.352971+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.538230+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.677063+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.809514+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:09.945229+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:09.946512+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:10.135086+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.537834+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.722492+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:10.814591+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:10.848447+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.139281+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.300906+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.387887+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:11.420972+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.689039+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:11.690327+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:11.977024+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.143642+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.276870+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.278225+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.599489+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.727657+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:12.864702+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:12.866430+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:13.468252+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:13.470601+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:13.793135+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:13.877828+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:13.914209+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.137117+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.203520+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.235993+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.265497+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.338261+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:14.431464+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:14.990310+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:15.012562+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.219611+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.337206+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:15.339581+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:15.792336+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:15.821799+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.047084+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.064012+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.265635+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.288236+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.489747+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.505748+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.586999+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.610277+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.610319+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.632546+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:16.706993+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:16.943682+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:17.192697+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:17.280955+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.019409+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.026519+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.173412+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.176484+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.347796+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.348419+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:18.989897+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:18.991945+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.271106+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:19.280058+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.581049+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:19.641471+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.835968+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:19.956405+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:20.768322+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:20.915720+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:20.968158+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.045838+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.091430+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.169534+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.341476+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.673838+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:21.749806+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:21.950021+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.072285+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.151360+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.235529+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:22.498972+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:22.553728+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:22.678499+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:23.131037+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:23.936828+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:23.986641+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:24.138116+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.189533+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:24.428499+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.583203+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.784286+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:24.875730+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.035670+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.038643+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.226072+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.331980+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.359924+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.499508+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:25.653275+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:25.672941+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:26.659268+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:26.734380+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:26.810089+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:26.854602+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:27.055801+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:27.151493+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:27.423442+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:27.425408+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:27.594974+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.063602+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.072836+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.295589+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.385566+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.385826+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.417526+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:28.508667+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:28.601560+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.012362+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.013234+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.260786+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.341052+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.341553+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.582762+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.583589+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:30.749619+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:30.993442+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.037548+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.247616+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.331551+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.365092+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.566902+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.570138+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.654341+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.686962+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.771208+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.806953+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:31.888216+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:31.892544+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.008185+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.015911+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.107607+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.356718+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.422992+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.423040+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.543451+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.664643+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.744366+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.745550+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:32.945541+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:32.964190+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:33.046171+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.165624+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.408710+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.474752+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:33.652707+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.730183+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.853771+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:33.931303+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.052507+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.114406+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.273089+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.292710+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.373996+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.494034+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.498249+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.615675+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.619590+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.699343+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.739784+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:34.819404+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.937354+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:34.984099+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.146673+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.185318+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.185386+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.305420+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.319611+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.386456+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.386537+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:35.467917+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.587596+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.822725+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:35.891457+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.222520+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.300524+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.501709+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.510442+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.741127+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.754633+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:36.904853+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.984703+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:36.984767+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.067523+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.078518+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.185877+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.192653+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.407888+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.471596+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.670526+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.682296+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:37.793084+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:37.907377+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:38.681967+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:38.825002+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:38.915611+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.373600+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.451317+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.496390+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.615783+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.616607+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.693286+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.779486+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.817684+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.894018+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:39.895566+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:39.940572+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.143981+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.158851+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.264621+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.351694+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:40.388721+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:40.472045+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:41.811656+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:41.814292+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.012797+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.013577+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.576102+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.619959+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.697012+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.740975+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.820984+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:42.861091+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:42.942147+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.062207+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.142475+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.143783+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:43.368377+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.383783+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:43.816319+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:43.829587+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:44.030788+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.056667+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:44.154611+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.300168+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.866152+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.948367+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:44.948422+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:21:45.069032+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:45.451221+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:52.236844+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:21:52.236844+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	179.43.171.209	7000	192.168.2.4	49730	TCP
2024-11-30T17:22:12.165081+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.4	49730	179.43.171.209	7000	TCP
2024-11-30T17:22:12.887645+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	179.43.171.209	7000	192.168.2.4	49730	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 30, 2024 17:19:57.577586889 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:19:57.701719046 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:19:57.701924086 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:19:57.839016914 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:19:57.964528084 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:08.583015919 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:08.709357977 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:09.010710001 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:09.065313101 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:09.245403051 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:09.366086960 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:19.222011089 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:19.342288017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:19.643362999 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:19.645452976 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:19.765765905 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:22.214593887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:22.255938053 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:29.878207922 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:29.998410940 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:30.299793005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:30.302783012 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:30.422804117 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:40.534327984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:40.660999060 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:40.975938082 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:40.977605104 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:41.097594023 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:51.190617085 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:51.310652971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:51.611824036 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:51.614356995 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:51.735913038 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:52.221493006 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:52.268562078 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:56.878978014 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:56.998909950 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:56.999001026 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.182224989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.269470930 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.300060987 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.346663952 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.389451981 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.390070915 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.501282930 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.510123014 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.510175943 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.634987116 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.702544928 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.753055096 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.801461935 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.836220980 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.877908945 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:57.921432018 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:57.921504021 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.041939974 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.042668104 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.162928104 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.300704002 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.425280094 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.488316059 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.523684025 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.565395117 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.614597082 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.614643097 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.726283073 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.726334095 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.735033989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.846451998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.846503019 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.927385092 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.927449942 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:58.967267036 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:58.967317104 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.047419071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.047470093 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.087462902 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.087507010 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.168067932 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.175390005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.221646070 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.251477957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.253648996 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.377053022 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.377172947 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.429050922 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.471666098 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.500423908 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.500581980 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.578430891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.624973059 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.625102043 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.672741890 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.721709013 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.751588106 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.751879930 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.826370955 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.872083902 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.872422934 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:20:59.992470980 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:20:59.992727041 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.113028049 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.113466024 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.220953941 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.233896971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.234009027 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.353967905 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.354017973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.422310114 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.477452993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.496387005 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.572969913 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.573021889 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.616309881 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.616369963 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.684048891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.694207907 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.736346006 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.737282038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.771455050 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.817675114 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.891750097 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:00.940407991 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:00.949361086 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.069854021 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.253633022 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.373909950 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.409468889 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.531256914 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.585094929 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.674936056 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.675124884 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.705051899 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.705482960 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.796308041 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.796365976 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:01.825531960 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.876034021 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.916980982 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:01.917490005 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.026735067 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.026782036 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.039064884 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.039160013 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.150407076 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.150573015 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.150729895 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.163641930 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.163768053 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.273921967 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.274050951 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.286483049 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.352132082 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.394068003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.397491932 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.475069046 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.477770090 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.517486095 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.518922091 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.597280979 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.597781897 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.640053034 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.640331984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.716808081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.716886997 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.765108109 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.765160084 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.798537970 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.798599958 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.883435965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.883481026 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:02.891995907 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:02.925041914 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.004745960 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.008769035 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.008841991 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.128825903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.128879070 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.248820066 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.280555964 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.283529997 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.450207949 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.452107906 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.525260925 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.525609016 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.606363058 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.609512091 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.699460030 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.726281881 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.729460001 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:03.831057072 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:03.939472914 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.059382915 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.082277060 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.202447891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.202510118 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.322628975 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.322681904 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.442656994 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.442707062 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.564346075 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.564388037 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.687771082 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.835902929 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:04.838587999 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:04.958686113 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.034487009 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.082154989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.143563986 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.154576063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.154649019 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.276478052 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.283334017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.284858942 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.447674990 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.581449986 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.587884903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.701514006 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.701746941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.788976908 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.789041042 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.822797060 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.822962046 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:05.910151005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:05.943064928 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.002525091 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.003144026 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.129868984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.129910946 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.144229889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.248776913 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.248891115 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.311467886 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.311705112 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.373995066 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.431710005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.470566034 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.471937895 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.639494896 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.639642000 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.759629011 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:06.759722948 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:06.879834890 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.157687902 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.160353899 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.280440092 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.358637094 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.366014004 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.481894970 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.489166021 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.489259958 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.616039991 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.616096973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.741647005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.745515108 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.865649939 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.865808964 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:07.986885071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:07.986943960 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.107192039 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.107291937 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.122942924 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.267611980 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.271437883 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.271588087 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.308331966 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.308407068 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.364888906 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.365000010 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.391428947 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.391474009 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.432265043 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.484934092 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.485096931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.511378050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.565936089 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.605087042 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.605158091 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.676654100 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.676940918 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.727776051 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.727824926 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.801342010 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.850678921 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.862799883 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:08.878074884 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:08.940469980 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.027586937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.027628899 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.148642063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.208437920 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.209974051 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.337083101 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.350039005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.352971077 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.523488998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.523547888 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.538229942 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.641495943 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.644023895 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.644083977 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.677062988 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.807532072 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.809514046 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:09.933784962 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.945229053 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:09.946511984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.111525059 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.111814022 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.135086060 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.231833935 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.231904984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.270443916 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.395503998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.395615101 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.521217108 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.523699045 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.537833929 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.643559933 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.687433958 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.687555075 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.722491980 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.814327955 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.814590931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.848447084 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.940429926 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:10.979450941 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:10.979501963 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.015749931 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.099632978 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.099677086 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.139281034 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.237317085 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.267451048 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.267503977 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.300905943 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.346709967 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.387583017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.387887001 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.420972109 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.534241915 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.555485964 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.555532932 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.675654888 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.689038992 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.690326929 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.855529070 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.855592012 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.976038933 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:11.976134062 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:11.977024078 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.034183025 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.143450975 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.143641949 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.263664961 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.276870012 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.278224945 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.443538904 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.443605900 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.464962959 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.534179926 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.563771009 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.563816071 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.599488974 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.643558979 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.727530003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.727657080 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:12.849040985 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.864701986 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:12.866430044 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.031511068 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.031583071 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.151743889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.151846886 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.271774054 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.347090006 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.468251944 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.468302011 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.470541000 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.470601082 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.591784954 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.591855049 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.593750954 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.669414997 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.669508934 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.711750031 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.713500977 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.791722059 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.791790962 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.793134928 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.846688986 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.877623081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.877827883 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:13.913346052 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:13.914208889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.034203053 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.034890890 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.034980059 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.137116909 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.137181044 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.203454971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.203520060 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.235992908 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.263784885 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.265496969 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.331156015 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.338260889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.431416988 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.431463957 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.465049982 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.465096951 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.555372953 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.555421114 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.580652952 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.639770985 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.639828920 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.677324057 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.759757042 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.759807110 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.883151054 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:14.883197069 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:14.990309954 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.012516975 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.012562037 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.135983944 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.218111038 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.219610929 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.337205887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.337518930 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.339504957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.339581013 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.456594944 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.457444906 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.459467888 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.459517956 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.579469919 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.579514027 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.699464083 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.701735973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.792335987 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.821748018 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.821799040 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:15.941682100 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:15.941816092 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.047084093 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.047146082 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.063955069 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.064012051 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.167992115 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.168045044 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.185589075 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.265635014 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.265691042 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.288192034 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.288235903 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.385592937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.385638952 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.408155918 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.489747047 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.505703926 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.505748034 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.586998940 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.610276937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.610318899 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.632505894 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.632545948 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.706993103 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.734307051 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.755551100 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:16.846694946 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:16.943681955 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.033792973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.192697048 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.280955076 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.400904894 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.400957108 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.526258945 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.597351074 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.717329979 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.717525959 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.844316959 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:17.845530987 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:17.972089052 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.019408941 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.026519060 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:18.146420002 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.173412085 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.176484108 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:18.347495079 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.347795963 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.348418951 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:18.470509052 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.566168070 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:18.688709021 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.849167109 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:18.970026970 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.989897013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:18.991945028 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.159451962 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.159545898 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.271106005 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.271163940 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.280006886 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.280057907 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.398488998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.406764984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.581048965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.641470909 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.768414974 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.828824043 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.835968018 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:19.956355095 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:19.956404924 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.077833891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.347217083 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.467251062 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.469526052 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.589545965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.589637041 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.714482069 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.717540979 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.768321991 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.809371948 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.843858957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.843955994 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:20.915719986 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.968091011 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:20.968158007 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.045838118 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.091387987 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.091429949 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.169533968 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.169611931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.217494965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.217550993 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.292007923 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.295455933 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.295799017 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.341356993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.341475964 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.415640116 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.434271097 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.507558107 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.507853985 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.627867937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.628005981 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.673837900 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.677768946 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.748718023 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.749805927 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.798662901 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.799089909 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.829225063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.911401033 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.911763906 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:21.920960903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:21.950021029 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.072284937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.072722912 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.151360035 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.151694059 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.235466003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.235528946 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.271759033 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.273663044 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.331083059 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.352432013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.352478981 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.403429985 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.477165937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.498971939 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.553728104 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.620305061 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.643589973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:22.678498983 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:22.831082106 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.131036997 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.250915051 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.250962019 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.370897055 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.370949030 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.491168976 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.491247892 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.611238956 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.611449957 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.737853050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.737896919 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.863898993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.864056110 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:23.936827898 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.986584902 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:23.986640930 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.106966019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.107089043 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.138115883 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.141526937 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.187933922 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.189532995 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.261490107 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.261691093 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.308348894 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.381822109 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.381877899 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.428498983 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.583203077 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.583270073 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.709180117 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.709245920 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.784286022 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.784341097 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.875494957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.875730038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.904870987 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:24.904928923 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:24.996181965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.025243044 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.035670042 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.038642883 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.211431026 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.211560965 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.226072073 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.331918001 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.331979990 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.359924078 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.481514931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.499429941 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.499507904 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.533282042 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.620476007 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.643589973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.653275013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.672940969 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.839483976 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:25.839612961 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:25.959650993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.238101006 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.358089924 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.358185053 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.481405020 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.487737894 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.608438969 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.608493090 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.659267902 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.734328032 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.734380007 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.810089111 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.854549885 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.854602098 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.935519934 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.935595036 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:26.974497080 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:26.974714994 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.055546999 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.055628061 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.055800915 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.143594027 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.151427031 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.151493073 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.175748110 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.175792933 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.273525000 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.273694038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.393656969 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.423441887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.425407887 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.587435007 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.587498903 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.594974041 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.643595934 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.707567930 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.707617044 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.827538013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.827668905 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:27.948021889 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:27.948086023 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.063601971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.063846111 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.072571993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.072835922 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.184221983 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.237025976 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.292218924 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.295588970 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.385565996 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.385826111 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.415618896 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.417526007 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.506531954 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.508666992 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.599508047 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:28.601560116 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:28.722161055 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:29.588907957 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:29.710875988 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:29.710920095 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:29.831629038 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:29.831693888 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:29.957403898 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.012362003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.013233900 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.137454033 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.137506962 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.258353949 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.258611917 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.260786057 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.341052055 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.341552973 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.423444986 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.425546885 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.463677883 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.548201084 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.582762003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.583589077 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.749619007 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.749675035 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.911438942 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.913532972 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:30.993442059 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:30.993494987 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.036310911 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.037548065 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.120279074 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.120330095 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.163675070 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.165535927 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.243037939 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.245544910 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.247616053 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.293652058 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.331504107 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.331551075 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.365092039 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.365370035 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.365544081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.448750019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.448798895 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.453077078 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.453182936 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.485822916 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.566901922 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.566977024 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.569937944 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.570137978 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.574227095 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.654340982 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.686893940 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.686961889 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.690097094 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.771208048 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.771265984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.806898117 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.806952953 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.888216019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.889544964 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.892482042 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:31.892544031 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:31.927551985 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.008184910 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.008266926 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.015866041 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.015911102 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.019325018 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.107606888 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.107717991 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.221811056 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.221863031 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.222367048 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.254878044 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.255089045 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.342175961 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.342233896 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.356718063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.422991991 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.423039913 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.523413897 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.523466110 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.543113947 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.543451071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.591100931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.664643049 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.665558100 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.744365931 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.745549917 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.835438013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.837543964 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.844774008 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.871295929 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.873543978 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.945540905 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.945589066 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:32.964126110 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:32.964190006 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.000113964 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.000159979 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.046170950 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.090923071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.090976000 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.165623903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.165694952 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.273516893 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.273669958 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.347404957 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.347460985 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.393644094 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.408710003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.408777952 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.474685907 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.474751949 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.575428963 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.575521946 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.594624996 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.594857931 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.643604040 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.652707100 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.655553102 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.730182886 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.730268955 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.823401928 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.823457956 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.851092100 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.853770971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.931303024 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.931380987 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:33.991420984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:33.991481066 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.052506924 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.052552938 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.052826881 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.114244938 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.114406109 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.172564983 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.172621965 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.234405041 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.273088932 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.292623043 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.292710066 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.373996019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.374047041 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.414328098 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.415586948 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.494034052 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.498039007 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.498249054 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.539397955 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.615674973 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.615730047 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.618292093 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.619590044 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.699342966 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.699846029 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.736011028 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.739784002 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.739991903 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.819403887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.819487095 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.819793940 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.861835003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.861881971 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:34.937354088 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.940162897 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.984003067 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:34.984098911 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.020936012 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.143611908 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.146672964 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.146738052 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.185317993 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.185385942 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.305372953 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.305419922 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.319611073 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.319838047 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.386456013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.386537075 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.439901114 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.440148115 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.467916965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.532830954 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.551466942 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.551528931 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.560246944 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.587595940 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.587661982 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.707591057 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.707653999 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:35.822725058 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.891407013 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:35.891457081 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.016129971 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.016313076 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.023798943 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.143640041 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.179426908 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.179533005 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.222520113 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.223922968 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.300465107 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.300523996 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.337441921 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.337539911 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.387440920 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.387523890 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.423182964 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.463141918 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.463401079 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.501708984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.510385036 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.510442019 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.583393097 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.583446980 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.630656004 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.703610897 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.741127014 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.754632950 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.904853106 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.904936075 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:36.984703064 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:36.984766960 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.067466021 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.067523003 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.078517914 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.105854988 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.105916023 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.185877085 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.185945034 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.192594051 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.192652941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.232749939 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.407887936 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.471535921 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.471596003 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.591864109 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.670526028 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.682296038 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:37.793083906 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.809226036 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:37.907377005 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.030149937 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.254265070 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.380790949 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.380887032 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.501065969 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.501183987 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.623296976 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.623356104 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.681967020 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.682027102 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.748140097 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.748182058 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.806438923 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.806615114 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.825001955 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.825057030 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.915476084 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.915611029 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.928985119 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.929040909 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:38.933337927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:38.933418989 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.038111925 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.052165031 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.052411079 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.057063103 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.129816055 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.129889965 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.172375917 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.175029993 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.239371061 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.239424944 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.249820948 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.249924898 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.295047998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.370856047 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.370913029 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.370959997 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.373600006 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.451086998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.451317072 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.496390104 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.496445894 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.615478992 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.615782976 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.616466045 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.616606951 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.693285942 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.693352938 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.779444933 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.779485941 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.814275026 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.814326048 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.817683935 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.894017935 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.895565987 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:39.939764977 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:39.940572023 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.063180923 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.143980980 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.158850908 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.264621019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.331140995 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.351439953 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.351694107 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.388720989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.440520048 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.471816063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:40.472044945 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:40.591981888 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:41.363078117 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:41.483522892 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:41.483836889 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:41.629687071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:41.811655998 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:41.814291954 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:41.939143896 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.012797117 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.013576984 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.133666039 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.133714914 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.253612995 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.253757000 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.373953104 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.375606060 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.495769024 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.499768972 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.576102018 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.576159000 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.619700909 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.619959116 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.697011948 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.697241068 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.740923882 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.740974903 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.820983887 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.821145058 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.860965967 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.861090899 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:42.941164017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.942147017 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:42.942212105 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.023433924 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.023668051 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.062206984 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.062236071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.142474890 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.142548084 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.143732071 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.143783092 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.262505054 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.262628078 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.263753891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.368376970 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.369302988 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.382853031 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.383783102 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.489665985 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.489852905 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.504205942 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.583955050 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.584002972 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.614947081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.615000010 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.690834999 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.709553003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.709600925 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.738415003 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.738456011 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.816318989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.816402912 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.829541922 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.829586983 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.858372927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.858542919 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.910795927 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.910865068 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.936407089 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.936578989 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:43.949737072 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.978538036 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:43.978583097 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.030787945 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.030855894 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.030888081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.056612968 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.056667089 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.098795891 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.098890066 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.150743961 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.150793076 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.154611111 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.224184990 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.224251986 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.232139111 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.300168037 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.300261021 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.425527096 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.425601959 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.544764996 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.544821024 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.626744032 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.626861095 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.746854067 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.747287989 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.866152048 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.866240978 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:44.948367119 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:44.948421955 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:45.068799019 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:45.069031954 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:45.187438965 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:45.187484026 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:45.451220989 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:45.645545006 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:21:52.236844063 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:21:52.284293890 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:22:12.165081024 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:22:12.459487915 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:22:12.460537910 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:22:12.586471081 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:22:12.824214935 CET	49730	7000	192.168.2.4	179.43.171.209
Nov 30, 2024 17:22:12.887645006 CET	7000	49730	179.43.171.209	192.168.2.4
Nov 30, 2024 17:22:12.887706995 CET	49730	7000	192.168.2.4	179.43.171.209

Target ID:	0
Start time:	11:19:53
Start date:	30/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x800000
File size:	1'723'904 bytes
MD5 hash:	7AC5198E128DEDA55EEEB6CCFC8B57EA
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000002.3032446698.0000000000802000.00000040.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000003.1666415670.0000000004FA0000.00000004.00001000.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3035777047.0000000005391000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:19:56
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "github" /tr "C:\Users\user\AppData\Roaming\github.exe"
Imagebase:	0xa70000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	11:19:56
Start date:	30/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:21:44
Start date:	30/11/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7528 -s 2632
Imagebase:	0x170000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	16.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	51
Total number of Limit Nodes:	6

Executed Functions

Function 05364A68 Relevance: 6.7, Strings: 5, Instructions: 483
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

;^q, xrefs: 05365493
,bbq, xrefs: 053654E7
@b^q, xrefs: 053654B3
$^q, xrefs: 053654A1
], xrefs: 05364A96

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: ,bbq$@b^q$]$$^q$;^q
API String ID: 0-811305235
Opcode ID: 42ebb64f70a92b88713e971750cd9706239ddd974e681bc4035c18a66aaf52c7
Instruction ID: fa7eb758642e9419ec3cc693bbbcd0ced05727ff7100a03c86ced67df673b9bd
Opcode Fuzzy Hash: 42ebb64f70a92b88713e971750cd9706239ddd974e681bc4035c18a66aaf52c7
Instruction Fuzzy Hash: 82025D34B002188FDB15DF28D894BAE7BB6BF89701F1484A9E9099B395CF71DC81CB91

Function 0536E370 Relevance: 5.4, Strings: 4, Instructions: 438
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

,bq, xrefs: 0536E640
(o^q, xrefs: 0536E5BA
(o^q, xrefs: 0536E5C8
,bq, xrefs: 0536E632

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: (o^q$(o^q$,bq$,bq
API String ID: 0-879173519
Opcode ID: 79e51a05a9161fd04d1ec10e0cb811bafdb832d3f50932f6ba129ac35777140e
Instruction ID: baf60846e0a6f4257459c399f3a74cc5a5d5f95e58ebf8a96db2114248fb10c2
Opcode Fuzzy Hash: 79e51a05a9161fd04d1ec10e0cb811bafdb832d3f50932f6ba129ac35777140e
Instruction Fuzzy Hash: 2E027E38A00209DFDB15CFA8C984AAEBBBAFF48300F14C469E415EB265DB74DD49DB51

Function 091A27F8 Relevance: 4.6, Strings: 3, Instructions: 837
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

Te^q, xrefs: 091A324B
-3, xrefs: 091A325F
-3, xrefs: 091A31E1

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID: -3$ -3$Te^q
API String ID: 0-3587138022
Opcode ID: b9b6a6f522c15eea79c3f4dc70144ed62b5affd6217b38a3f32ed7e7b35718f8
Instruction ID: 4dcbd5df02b0be3f623eb15b4b065499e6e3483dedea41fa8851098a5ba3bd78
Opcode Fuzzy Hash: b9b6a6f522c15eea79c3f4dc70144ed62b5affd6217b38a3f32ed7e7b35718f8
Instruction Fuzzy Hash: 7152A434B103108FDB0AEB74D859B2E77A7AF88704F15891CE9169B3A4DF36DC428B91

Function 0536441F Relevance: 4.4, Strings: 3, Instructions: 618COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0536482E
Hbq, xrefs: 053648CE
], xrefs: 05364A96

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: Hbq$Hbq$]
API String ID: 0-65184884
Opcode ID: 828b099d202c30f0d60921188d43be58fd822bcb2b53906eab8fdb1f54d0b1c7
Instruction ID: dad78b08e09e8d2941a2f45a247fc453186080f1dcc5099d40867f18b8d184b0
Opcode Fuzzy Hash: 828b099d202c30f0d60921188d43be58fd822bcb2b53906eab8fdb1f54d0b1c7
Instruction Fuzzy Hash: 3522AD30B002189FDF15DF68D894BAE7BA7BF88700F148469E506AB394CE75CD41CBA6

Function 05361030 Relevance: 4.2, Strings: 3, Instructions: 491
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$^q, xrefs: 0536148C
$^q, xrefs: 05361498
$^q, xrefs: 05361472

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: $^q$$^q$$^q
API String ID: 0-831282457
Opcode ID: 7a4e28013a3bdcbe65cb4171953e8341e6b6e15f61aa4eddb8f519e2cc3f7641
Instruction ID: d60781e41f62ead0d99f22376e7eae358e6a9b7f508bcbee56bee62adae8dcaf
Opcode Fuzzy Hash: 7a4e28013a3bdcbe65cb4171953e8341e6b6e15f61aa4eddb8f519e2cc3f7641
Instruction Fuzzy Hash: 8302C6307202049FEB099B74D959B6E7BA7FF88700F108528E506DB3A8DF769C468B91

Function 0536DD48 Relevance: 3.0, Strings: 2, Instructions: 511COMMON

Download Yara Rule

Strings

Hbq, xrefs: 0536E14E
(o^q, xrefs: 0536E282

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: (o^q$Hbq
API String ID: 0-662517225
Opcode ID: d87c7ffa60eaabaf8764722a217e41fb05cbfd6d14fd86de9a4bb2167511764d
Instruction ID: 69413f59018a8ba26dfd97a09abaaff00dd3c6df4f8ba3f29f806d49f76bab66
Opcode Fuzzy Hash: d87c7ffa60eaabaf8764722a217e41fb05cbfd6d14fd86de9a4bb2167511764d
Instruction Fuzzy Hash: 5012AC74B002198FDB15DFA9C854AAEBBFABF88300F14C569E405EB394DF349946CB91

Function 0536BD70 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

LR^q, xrefs: 0536C284
Xbq, xrefs: 0536BD8A

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: LR^q$Xbq
API String ID: 0-1504435008
Opcode ID: 44fe0d87ed9e3c65cce3e8f09d292bcfc1fbff642d0608645f6b474945d7848d
Instruction ID: ed4ed04c3e550eb80d05130e6189fcc04c1d0d8bcc7d07c209c786ef668d9af4
Opcode Fuzzy Hash: 44fe0d87ed9e3c65cce3e8f09d292bcfc1fbff642d0608645f6b474945d7848d
Instruction Fuzzy Hash: B3C16770F0421DCBDF185F6694582AEBEB6BF88B00F28985DD482EA648DF34CC558F65

Function 053698E0 Relevance: 1.5, Strings: 1, Instructions: 281COMMON

Download Yara Rule

Strings

\Vam, xrefs: 05369B97

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: \Vam
API String ID: 0-2269870599
Opcode ID: bef7e20ae6e7489ff4535855acfeb27a23b84ea9338d242f3262b2fd6b72c627
Instruction ID: 30d740aca2c21de8658f1486622fa631853b925c78b9ef3f5f06d5f009b63f89
Opcode Fuzzy Hash: bef7e20ae6e7489ff4535855acfeb27a23b84ea9338d242f3262b2fd6b72c627
Instruction Fuzzy Hash: D1B15C71E04209CFDB14CFA9C9957AEBBF2BF88354F14C12DD419A7298EBB49845CB81

Function 0536A1B0 Relevance: .3, Instructions: 266COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10a08709c86e8deba74102cee0128f5c189693600cffb3d3e8f0a21cdf02896
Instruction ID: 494dd944b6a66e4048dd78a60d517c1fc1ec2450bf9e073f33d20542afea1c48
Opcode Fuzzy Hash: f10a08709c86e8deba74102cee0128f5c189693600cffb3d3e8f0a21cdf02896
Instruction Fuzzy Hash: 82B13A70E04209CFDB10CFA9D8957ADBBF2BF88314F24C52DD419A7298EB759895CB81

Function 091A0AA8 Relevance: 2.6, Strings: 2, Instructions: 106COMMON

Download Yara Rule

Strings

$^q, xrefs: 091A0B87
$^q, xrefs: 091A0B64

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID: $^q$$^q
API String ID: 0-355816377
Opcode ID: 4a01732defc3a06ad517abe187053d1acbe96dd15c5c5ce1020b08dc7fcc146d
Instruction ID: a943cb9af94899a4b6851ce09dd1fad655da83fdd8224e5e90e3fe645848fcee
Opcode Fuzzy Hash: 4a01732defc3a06ad517abe187053d1acbe96dd15c5c5ce1020b08dc7fcc146d
Instruction Fuzzy Hash: 3331C6787042158FCB198F39C99563E7B65EB8A74DB19086AE052CB291EF24DCC1C752

Function 0536B980 Relevance: 1.6, APIs: 1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13dab9d573ee4da3f892029dda3a102ddef5ade1b7c47ba9c5124af120bea16
Instruction ID: ff715934e05506673ebad67b54a1c55e758293b1b703682250af6fcd65a0929c
Opcode Fuzzy Hash: c13dab9d573ee4da3f892029dda3a102ddef5ade1b7c47ba9c5124af120bea16
Instruction Fuzzy Hash: DC41E072E047598FCB04CFB9D8542EEFBF1EF8A220F14866AD408E7251DB749845CBA1

Function 0536B2EA Relevance: 1.6, APIs: 1, Instructions: 60COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0536B9D2), ref: 0536BABF

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: 4c10d020a4050d20ce6ff34c4448d6ee65038714d84c6cc3e5f77673b12780e0
Instruction ID: 791a709f42f80637b067b10965f0f3d8f3b69f23c36aca72fad718497d08af89
Opcode Fuzzy Hash: 4c10d020a4050d20ce6ff34c4448d6ee65038714d84c6cc3e5f77673b12780e0
Instruction Fuzzy Hash: 222135B6C0465ADFCB10CFAAC44469EFBF4FB08320F15816AD858A7245D378A944CFA1

Function 0536B27C Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0536B9D2), ref: 0536BABF

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: a043e88b8056c352f364cf489f3a81a38d06bac576a065a4962dfcf5cd67c243
Instruction ID: 6777469f76be304851c48d4c5c93ff837e966333f5d101e8e7f0c3e6e7b7fd5b
Opcode Fuzzy Hash: a043e88b8056c352f364cf489f3a81a38d06bac576a065a4962dfcf5cd67c243
Instruction Fuzzy Hash: F51103B5C046599BCB10CF9AC548B9EFBF4EB48320F14816AE918A7250D378A944CFA5

Function 0536BA50 Relevance: 1.6, APIs: 1, Instructions: 55COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32(?,?,?,?,?,?,?,?,?,0536B9D2), ref: 0536BABF

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID: GlobalMemoryStatus
String ID:
API String ID: 1890195054-0
Opcode ID: e80ada7ce9ac4992e597a3749bb1d86bc583d16d7bdadc71666260d28ce5c06b
Instruction ID: 20fe876a6513414dd00e96101ac925f1a19242edee460958c96f1bf863698c7f
Opcode Fuzzy Hash: e80ada7ce9ac4992e597a3749bb1d86bc583d16d7bdadc71666260d28ce5c06b
Instruction Fuzzy Hash: B31144B6C006599FCB10CFAAC4447DEFBB0FF09320F14826AD818A7200D778A941CFA5

Function 091A1018 Relevance: 1.4, Strings: 1, Instructions: 126COMMON

Download Yara Rule

Strings

(o^q, xrefs: 091A1191

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID: (o^q
API String ID: 0-74704288
Opcode ID: 740728961f48224a2c309720f6bf1f4d0b87e3fcc63e34c33e196d67c64a1829
Instruction ID: 6f71756f76be9c5ab11a66ec1a272bc6ff82985b1bcc457bb6e450049422f402
Opcode Fuzzy Hash: 740728961f48224a2c309720f6bf1f4d0b87e3fcc63e34c33e196d67c64a1829
Instruction Fuzzy Hash: CA41DD35B042049FCB099F79D998AAE7BB6BFC8750F148469E906DB391CF349C02CB95

Function 091A0EF1 Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 12b6b24bf5ba2f55b00c80dda043980688b28df12641db1e9d70a69c83bbac08
Instruction ID: 360762328f70f3eacc1526e49f8dfb482942a9f6fcfe14bf9ceb4bbb0ec835d2
Opcode Fuzzy Hash: 12b6b24bf5ba2f55b00c80dda043980688b28df12641db1e9d70a69c83bbac08
Instruction Fuzzy Hash: AE312439B042009FDB248E68D995BAE7BB2EF8D314F14842AF516E7390CB35DC02C791

Function 091A3528 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7478541fbce2fb7647b639b4413c4fa5fa439cf523eed64682233a51de4b65ec
Instruction ID: cc84beb4efc08f8ba182946426408ece4c29b95cee100c0ad5a23d32cabb8cc2
Opcode Fuzzy Hash: 7478541fbce2fb7647b639b4413c4fa5fa439cf523eed64682233a51de4b65ec
Instruction Fuzzy Hash: 4611A334F002049BDB589E7D9C147BF76A6AF84754F048929E926D7380EB30CD0287D0

Function 091A1774 Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d05b3a4fdc7374350bfe81b890215ab42138dcc37d813ca6c3c5cb07e9342c27
Instruction ID: fb65be8ec75bcae415c59bbcc866c5a72f94c2ff90ae1b6856e46e103f8f1f9d
Opcode Fuzzy Hash: d05b3a4fdc7374350bfe81b890215ab42138dcc37d813ca6c3c5cb07e9342c27
Instruction Fuzzy Hash: 79F020A5D4C3C0AEC7228BB888050627FB0D912265B8942CED0E68B462E6288803C742

Function 091A10C5 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 731f91eb8ad10c8137ee2f78ec06d23557ddce1544244328009feac200ffc0b7
Instruction ID: 11d51f1814c60284662e4a7061a857d80db5773b12feeff110716f9be3d958b0
Opcode Fuzzy Hash: 731f91eb8ad10c8137ee2f78ec06d23557ddce1544244328009feac200ffc0b7
Instruction Fuzzy Hash: 6ED0673AB40118DFCB149F99E8408DDFBB6FB98261B148116F915A3261CA319921DB94

Function 091A1731 Relevance: .0, Instructions: 16COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3de685c293b783765e86c0ed55653696598b95e96abee5a2a6e0fa8603c011a6
Instruction ID: 2d78841b5878bcf4f0b6d270cc2b2be120b3d8b3216cf1a8b2996a2646c73d21
Opcode Fuzzy Hash: 3de685c293b783765e86c0ed55653696598b95e96abee5a2a6e0fa8603c011a6
Instruction Fuzzy Hash: 6CE0C270C587C09ECB61CBBCC14509ABFF09A02235B4446DDD4FA8B946EB395453CB82

Function 091A1740 Relevance: .0, Instructions: 13COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ba35340d5b078c81a1a769acb286d3038266048e5ef27fd427b3e5144d963488
Instruction ID: 7fe67badffb58c1c6cf6af93d80a36f0288fc318657e38074e18a57f0487eeec
Opcode Fuzzy Hash: ba35340d5b078c81a1a769acb286d3038266048e5ef27fd427b3e5144d963488
Instruction Fuzzy Hash: 31D0C9B4D1430C9F8B80EFF8950516EBFF4BB04200F0145AAD819E3201FB348A118F92

Function 091A1709 Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3037710453.00000000091A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 091A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_91a0000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 02059b91e1e5d64bd451a4d36528f0ba7127d571fd579f7e8c022d7736c256b4
Instruction ID: 2d8b220ace26d9ea7e265df94782ffdde2f7939053b1e1df8633cea16c3b3501
Opcode Fuzzy Hash: 02059b91e1e5d64bd451a4d36528f0ba7127d571fd579f7e8c022d7736c256b4
Instruction Fuzzy Hash: F4D0C92094D7D05FCB03AB788A281483FF19E4321530948DFD1D29B1B7D5389946D71A

Non-executed Functions

Function 05361768 Relevance: 2.8, Strings: 2, Instructions: 260COMMON

Download Yara Rule

Strings

$^q, xrefs: 0536177E
Xbq, xrefs: 05361797

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: Xbq$$^q
API String ID: 0-1593437937
Opcode ID: e22b714c1f1611a4dea893ae6782b50e15931e670075484ac4b89169f51442dd
Instruction ID: 203b17fde1b67ade6eae5a361bc05b21ea19ae1b56c8a8b69d1b56009197d52c
Opcode Fuzzy Hash: e22b714c1f1611a4dea893ae6782b50e15931e670075484ac4b89169f51442dd
Instruction Fuzzy Hash: 1F816474B103189BDB58DB79985967E7FB7BFC8710B14C52DE406E7288DE348802CB96

Function 05369598 Relevance: 1.5, Strings: 1, Instructions: 238COMMON

Download Yara Rule

Strings

\Vam, xrefs: 053697E3

Memory Dump Source

Source File: 00000000.00000002.3035648531.0000000005360000.00000040.00000800.00020000.00000000.sdmp, Offset: 05360000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_5360000_file.jbxd

Similarity

API ID:
String ID: \Vam
API String ID: 0-2269870599
Opcode ID: c042b5f9a3dc242cfc364864cb74326602eb708a413fdab7682265a54177a935
Instruction ID: 42db95ad18b38cd8837b1e5a2d52956618f631de6a5868e6ca4d5ac445d23648
Opcode Fuzzy Hash: c042b5f9a3dc242cfc364864cb74326602eb708a413fdab7682265a54177a935
Instruction Fuzzy Hash: A5913871E042099FDF14CFA9C9957ADBBF2BF88314F14C12DE409AB258EB749846CB91

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_file.exe_e03c1446a791a6774320993325b3bfe7a93ee1_8bc8969b_23543bc7-22dc-4eef-847c-da056f5b3b50\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB1AB.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5C3.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB5F3.tmp.xml

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\github.lnk

C:\Windows\appcompat\Programs\Amcache.hve

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Windows Analysis Report
file.exe

Function 05364A68 Relevance: 6.7, Strings: 5, Instructions: 483
COMMON

Function 0536E370 Relevance: 5.4, Strings: 4, Instructions: 438
COMMON

Function 091A27F8 Relevance: 4.6, Strings: 3, Instructions: 837
COMMON

Function 05361030 Relevance: 4.2, Strings: 3, Instructions: 491
COMMON

Function 0536BD70 Relevance: 2.8, Strings: 2, Instructions: 332
COMMON