Edit tour

Windows Analysis Report
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Overview

General Information

Sample name:	1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe
Analysis ID:	1569856
MD5:	3b418fcbdd3c8e5b79ae86050618b81d
SHA1:	9d0400d7d4a46e7230dd3dc99a71daffc53a63c5
SHA256:	40c2d745989be5157f4d5f241251e1a9954e7377613b587fa82d530b149b34b1
Tags:	base64-decodedexeuser-abuse_ch
Infos:

Detection

XWorm

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XWorm

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to log keystrokes (.Net Source)

Found potential dummy code loops (likely to delay analysis)

Machine Learning detection for sample

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Sample uses string decryption to hide its real strings

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains long sleeps (>= 3 min)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Program does not show much activity (idle)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Yara signature match

Classification

Process Tree

System is w10x64

1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe (PID: 7572 cmdline: "C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe" MD5: 3B418FCBDD3C8E5B79AE86050618B81D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
XWorm	Malware with wide range of capabilities ranging from RAT to ransomware.	No Attribution	https://any.run/cybersecurity-blog/xworm-malware-communication-analysis/ https://any.run/cybersecurity-blog/xworm-technical-analysis-of-a-new-malware-version/ https://blog.cyble.com/2022/08/19/evilcoder-project-selling-multiple-dangerous-tools-online/ https://cert.pl/en/posts/2023/10/deworming-the-xworm/ https://embee-research.ghost.io/infrastructure-analysis-with-dns-pivoting/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xworm

Malware Configuration

Threatname: Xworm

{"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a38:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e6:$cnc4: POST / HTTP/1.1

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7838:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x78d5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x79ea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x74e6:$cnc4: POST / HTTP/1.1
00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
Process Memory Space: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe PID: 7572	JoeSecurity_XWorm	Yara detected XWorm	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack	JoeSecurity_XWorm	Yara detected XWorm	Joe Security
0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack	MALWARE_Win_AsyncRAT	Detects AsyncRAT	ditekSHen	0x7a38:$cnc1: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 0x7ad5:$cnc2: Mozilla/5.0 (iPhone; CPU iPhone OS 11_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.0 Mobile/15E148 Safari/604.1 0x7bea:$cnc3: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 0x76e6:$cnc4: POST / HTTP/1.1

Sigma Signatures

⊘No Sigma rule has matched

Suricata Signatures

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:52:06.002954+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:16.778441+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:23.027095+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:27.567317+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:38.342233+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:49.126388+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:53.017195+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.639653+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.801351+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.921319+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:58.306177+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:05.809388+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:08.693489+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.591029+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.782911+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.905454+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:18.716075+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:18.948431+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:20.746450+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.012394+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.762556+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.924998+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:28.750892+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:30.609207+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:31.763494+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:32.888725+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:34.262811+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:34.454784+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:44.887409+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:45.079370+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:45.271124+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:49.279664+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:52.998498+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:55.684383+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:55.876208+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:56.389277+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:58.840908+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:00.779183+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:04.529203+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:05.794343+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:05.958461+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:06.078235+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:06.240532+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:07.122548+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:10.920296+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:11.184397+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:11.376410+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:12.990964+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:14.013417+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:16.342457+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:16.505072+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:16.984613+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:17.104507+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:22.124513+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.005897+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.658723+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.850907+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:24.519619+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:28.221620+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:28.760552+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:32.649590+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:32.839444+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:35.594594+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.022256+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.214607+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.335754+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:41.754668+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:48.315321+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:48.473149+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:50.439572+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:53.035658+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:58.926838+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.044955+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.178003+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.297954+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:08.818148+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:10.195768+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:14.731719+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:14.923713+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:15.045782+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:15.237401+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:17.868212+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:19.643257+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:19.891435+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:20.022991+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:20.337860+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:23.012613+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:25.138915+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:25.717522+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:27.423800+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:30.779175+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:32.300740+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:33.856874+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:35.873755+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:36.056077+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:36.191030+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:38.716717+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:46.184847+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:46.376650+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:47.501331+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:47.846222+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:50.170508+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:51.138442+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:53.035494+0100	2852870	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP

ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:52:06.055024+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:16.780411+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:27.569032+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:38.344546+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:49.147451+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:57.921391+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:58.072299+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:58.424647+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:05.811383+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:08.700681+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:08.895596+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.593306+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.789182+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.909269+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:18.717507+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:18.951579+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:20.748544+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:24.019999+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:28.753510+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:30.615761+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:31.765570+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:32.894837+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.267587+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.456398+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.585553+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:44.962122+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:45.083732+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:45.273261+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:49.283012+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:55.686369+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:55.877932+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:56.391216+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:58.843235+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:00.783683+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:04.530906+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:05.928564+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:06.048596+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:06.208805+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:06.329837+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:07.127400+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:11.081864+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:11.201886+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:11.378092+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:13.037973+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:14.015697+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:17.049952+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:17.173922+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:22.126219+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:23.660874+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:23.854546+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:24.524045+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:28.223862+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:28.767975+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:32.651849+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:32.841253+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:35.596236+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.023978+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.225271+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.345178+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:41.756095+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.317788+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.479376+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.635266+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:50.444472+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:58.931930+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.106569+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.226422+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.346389+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.493041+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:08.824173+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:10.216774+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:14.733615+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:14.926085+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:15.048109+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:15.238976+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:17.870499+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:19.707571+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:19.893542+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.025183+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.207588+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.500231+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:25.196464+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:25.719587+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:25.912210+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:26.032649+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:27.426139+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:30.781523+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:32.305070+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:33.859411+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:35.879078+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:36.058058+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:36.202774+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:38.719818+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:46.188047+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:46.378739+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:47.576227+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:47.959549+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:50.172406+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:51.142269+0100	2852923	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP

ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:52:23.027095+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:53.017195+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.012394+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:52.998498+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.005897+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:53.035658+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:23.012613+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:53.035494+0100	2852874	1	Malware Command and Control Activity Detected	87.120.116.179	1300	192.168.2.10	49705	TCP

ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-06T10:53:18.446189+0100	2853193	1	Malware Command and Control Activity Detected	192.168.2.10	49705	87.120.116.179	1300	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Avira: detected

Found malware configuration

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Malware Configuration Extractor: Xworm {"C2 url": ["87.120.116.179"], "Port": 1300, "Aes key": "<123456789>", "SPL": "<Xwormmm>", "Install file": "USB.exe"}

Multi AV Scanner detection for submitted file

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

ReversingLabs: Detection: 84%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: 87.120.116.179
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: 1300
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: <123456789>
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: <Xwormmm>
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: 05-12-24
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	String decryptor: USB.exe

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2855924 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.10:49705 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852870 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes : 87.120.116.179:1300 -> 192.168.2.10:49705
Source: Network traffic	Suricata IDS: 2852923 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client) : 192.168.2.10:49705 -> 87.120.116.179:1300
Source: Network traffic	Suricata IDS: 2852874 - Severity 1 - ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2 : 87.120.116.179:1300 -> 192.168.2.10:49705
Source: Network traffic	Suricata IDS: 2853193 - Severity 1 - ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound : 192.168.2.10:49705 -> 87.120.116.179:1300

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 87.120.116.179

Source: global traffic

TCP traffic: 192.168.2.10:49705 -> 87.120.116.179:1300

Source: Joe Sandbox View

ASN Name: UNACS-AS-BG8000BurgasBG UNACS-AS-BG8000BurgasBG

Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179
Source: unknown	TCP traffic detected without corresponding DNS query: 87.120.116.179

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, 00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp

String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality to log keystrokes (.Net Source)

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, XLogger.cs

.Net Code: KeyboardLayout

System Summary

Malicious sample detected (through community Yara rule)

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, type: SAMPLE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects AsyncRAT Author: ditekSHen
Source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Detects AsyncRAT Author: ditekSHen

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Code function: 0_2_00007FF7C13268F6	0_2_00007FF7C13268F6
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Code function: 0_2_00007FF7C13276A2	0_2_00007FF7C13276A2
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Code function: 0_2_00007FF7C132A6A4	0_2_00007FF7C132A6A4

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, 00000000.00000000.1248950623.00000000008FC000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamerwalidad.exe4 vs 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Binary or memory string: OriginalFilenamerwalidad.exe4 vs 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, type: SAMPLE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT
Source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AsyncRAT author = ditekSHen, description = Detects AsyncRAT

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Helper.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, AlgorithmAES.cs	Cryptographic APIs: 'TransformFinalBlock'

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@1/0@0/1

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Mutant created: \Sessions\1\BaseNamedObjects\3K4hxUJ98OMO2ygA

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

ReversingLabs: Detection: 84%

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: avicap32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: msvfw32.dll	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Section loaded: winmm.dll	Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

.NET source code contains method to dynamically call methods (often used by packers)

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[5]{Settings.Host,Settings.Port,Settings.SPL,Settings.KEY,Helper.ID()}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[2]{Pack[2],Helper.Decompress(Convert.FromBase64String(Pack[3]))}}, (string[])null, (Type[])null, (bool[])null, true)
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: NewLateBinding.LateCall(obj, (Type)null, "Invoke", new object[2]{null,new object[1] { Pack[2] }}, (string[])null, (Type[])null, (bool[])null, true)

.NET source code contains potential unpacker

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: Plugin System.AppDomain.Load(byte[])
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: Memory System.AppDomain.Load(byte[])
Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, Messages.cs	.Net Code: Memory

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Memory allocated: D60000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	Memory allocated: 1AC90000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Window / User API: threadDelayed 9627

Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe TID: 8116	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe TID: 8120	Thread sleep count: 9627 > 30	Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe TID: 8120	Thread sleep count: 230 > 30	Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, 00000000.00000002.3688423444.000000001BC20000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllSy

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Found potential dummy code loops (likely to delay analysis)

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Process Stats: CPU usage > 42% for more than 60s

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Process token adjusted: Debug

Jump to behavior

Source: all processes

Thread injection, dropped files, key value created, disk infection and DNS query: no activity detected

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Queries volume information: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe VolumeInformation

Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntivirusProduct

Stealing of Sensitive Information

Yara detected XWorm

Source: Yara match	File source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe PID: 7572, type: MEMORYSTR

Remote Access Functionality

Yara detected XWorm

Source: Yara match	File source: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, type: SAMPLE
Source: Yara match	File source: 0.0.1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe.8f0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe PID: 7572, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	1 Input Capture	211 Security Software Discovery	Remote Services	1 Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	232 Virtualization/Sandbox Evasion	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	11 Archive Collected Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	232 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	2 Software Packing	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	13 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	84%	ReversingLabs	Win32.Trojan.Xworm
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	100%	Avira	TR/Spy.Gen
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
87.120.116.179	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
87.120.116.179	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe, 00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
87.120.116.179	unknown	Bulgaria		25206	UNACS-AS-BG8000BurgasBG	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1569856
Start date and time:	2024-12-06 10:50:57 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 5s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	12
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@1/0@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 4 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, sppsvc.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
VT rate limit hit for: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Simulations

Behavior and APIs

Time	Type	Description
04:51:58	API Interceptor	13046595x Sleep call for process: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
87.120.116.179	17334769266ba75a70859e94894e9fae5c33bba300e2b004c1166d236dc1ab2c8ff5669916631.dat-decoded.exe	Get hash	malicious	XWorm	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
UNACS-AS-BG8000BurgasBG	17334769266ba75a70859e94894e9fae5c33bba300e2b004c1166d236dc1ab2c8ff5669916631.dat-decoded.exe	Get hash	malicious	XWorm	Browse	87.120.116.179
	yIla7SeJ6r.doc	Get hash	malicious	XenoRAT	Browse	87.120.120.27
	gjot5vxpIC.exe	Get hash	malicious	XenoRAT	Browse	87.120.120.27
	file.exe	Get hash	malicious	Amadey, AsyncRAT, Stealc, Vidar	Browse	87.120.125.31
	po4877383.exe	Get hash	malicious	RedLine	Browse	87.120.120.86
	e824975.html	Get hash	malicious	Unknown	Browse	87.120.114.172
	qqig1mHX8U.exe	Get hash	malicious	AveMaria, DBatLoader, UACMe	Browse	87.120.125.217
	RFQ LIST 767655776478637584637865763478634365634444444444444444453.exe	Get hash	malicious	GuLoader	Browse	87.120.114.159
	New listed items 7648767856387547354734567465647568487.exe	Get hash	malicious	Discord Token Stealer, GuLoader	Browse	87.120.114.159

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	5.6123779876088244
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe
File size:	36'864 bytes
MD5:	3b418fcbdd3c8e5b79ae86050618b81d
SHA1:	9d0400d7d4a46e7230dd3dc99a71daffc53a63c5
SHA256:	40c2d745989be5157f4d5f241251e1a9954e7377613b587fa82d530b149b34b1
SHA512:	35cd3f4f4e39632c5edbc1b8bdb09b694b758a8652044b9e7a3ae525966ef0c1b01e11f3e8ddc2265f70ef7bcfa6df69f2b207d7cf08f4f580acfc93d17ffd26
SSDEEP:	768:GL13A5Uno9RfHWa2BLyeo8icH1bxbFb9ExOMhTQXv2:AxA5Uno9JHWX+eNicH1bBFb9ExOM562
TLSH:	62F24C48BB904216D9ED6BF5A97372020674E613DD17EB4E4CD48ADB6F23BC08D013EA
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...q.Qg................................. ........@.. ....................................@................................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x40a5ee
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x67519B71 [Thu Dec 5 12:24:17 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa598	0x53	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xc000	0x4e0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xe000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x85f4	0x8600	ab1c38b62583dbb99759221e841a8b1c	False	0.49903801305970147	data	5.747698558102092	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rsrc	0xc000	0x4e0	0x600	785720fcd290cca76b98e07cde1da14a	False	0.376953125	data	3.723002299043814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xe000	0xc	0x200	fd3ac7fbb8a34dc91e775b7c64e87bbc	False	0.044921875	data	0.08153941234324169	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0xc0a0	0x24c	data			0.47278911564625853
RT_MANIFEST	0xc2f0	0x1ea	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with CRLF line terminators			0.5469387755102041

Imports

DLL	Import
mscoree.dll	_CorExeMain

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-06T10:52:05.613158+0100	2855924	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:06.002954+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:06.055024+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:16.778441+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:16.780411+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:23.027095+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:23.027095+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:27.567317+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:27.569032+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:38.342233+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:38.344546+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:49.126388+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:49.147451+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:53.017195+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:53.017195+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.639653+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.801351+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.921319+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:57.921391+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:58.072299+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:52:58.306177+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:52:58.424647+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:05.809388+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:05.811383+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:08.693489+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:08.700681+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:08.895596+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.591029+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.593306+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.782911+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.789182+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:13.905454+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:13.909269+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:18.446189+0100	2853193	ETPRO MALWARE Win32/XWorm V3 CnC Command - PING Outbound	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:18.716075+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:18.717507+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:18.948431+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:18.951579+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:20.746450+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:20.748544+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:23.012394+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.012394+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.762556+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:23.924998+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:24.019999+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:28.750892+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:28.753510+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:30.609207+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:30.615761+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:31.763494+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:31.765570+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:32.888725+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:32.894837+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.262811+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:34.267587+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.454784+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:34.456398+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:34.585553+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:44.887409+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:44.962122+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:45.079370+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:45.083732+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:45.271124+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:45.273261+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:49.279664+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:49.283012+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:52.998498+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:52.998498+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:55.684383+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:55.686369+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:55.876208+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:55.877932+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:56.389277+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:56.391216+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:53:58.840908+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:53:58.843235+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:00.779183+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:00.783683+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:04.529203+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:04.530906+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:05.794343+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:05.928564+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:05.958461+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:06.048596+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:06.078235+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:06.208805+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:06.240532+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:06.329837+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:07.122548+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:07.127400+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:10.920296+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:11.081864+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:11.184397+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:11.201886+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:11.376410+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:11.378092+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:12.990964+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:13.037973+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:14.013417+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:14.015697+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:16.342457+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:16.505072+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:16.984613+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:17.049952+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:17.104507+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:17.173922+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:22.124513+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:22.126219+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:23.005897+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.005897+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.658723+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.660874+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:23.850907+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:23.854546+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:24.519619+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:24.524045+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:28.221620+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:28.223862+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:28.760552+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:28.767975+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:32.649590+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:32.651849+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:32.839444+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:32.841253+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:35.594594+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:35.596236+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.022256+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.023978+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.214607+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.225271+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:38.335754+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:38.345178+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:41.754668+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:41.756095+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.315321+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:48.317788+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.473149+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:48.479376+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:48.635266+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:50.439572+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:50.444472+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:54:53.035658+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:53.035658+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:58.926838+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:54:58.931930+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.044955+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.106569+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.178003+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.226422+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.297954+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:04.346389+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:04.493041+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:08.818148+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:08.824173+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:10.195768+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:10.216774+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:14.731719+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:14.733615+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:14.923713+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:14.926085+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:15.045782+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:15.048109+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:15.237401+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:15.238976+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:17.868212+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:17.870499+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:19.643257+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:19.707571+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:19.891435+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:19.893542+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.022991+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:20.025183+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.207588+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:20.337860+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:20.500231+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:23.012613+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:23.012613+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:25.138915+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:25.196464+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:25.717522+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:25.719587+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:25.912210+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:26.032649+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:27.423800+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:27.426139+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:30.779175+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:30.781523+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:32.300740+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:32.305070+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:33.856874+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:33.859411+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:35.873755+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:35.879078+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:36.056077+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:36.058058+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:36.191030+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:36.202774+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:38.716717+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:38.719818+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:46.184847+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:46.188047+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:46.376650+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:46.378739+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:47.501331+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:47.576227+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:47.846222+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:47.959549+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:50.170508+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:50.172406+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:51.138442+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:51.142269+0100	2852923	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes (Client)	1	192.168.2.10	49705	87.120.116.179	1300	TCP
2024-12-06T10:55:53.035494+0100	2852870	ETPRO MALWARE Win32/XWorm CnC Checkin - Generic Prefix Bytes	1	87.120.116.179	1300	192.168.2.10	49705	TCP
2024-12-06T10:55:53.035494+0100	2852874	ETPRO MALWARE Win32/XWorm CnC PING Command Inbound M2	1	87.120.116.179	1300	192.168.2.10	49705	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 6, 2024 10:51:54.536694050 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:51:54.656902075 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:51:54.657013893 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:51:54.833296061 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:51:54.953048944 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:05.613157988 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:05.733679056 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:06.002954006 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:06.044341087 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:06.055023909 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:06.174823999 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:16.388906956 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:16.508734941 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:16.778440952 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:16.780411005 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:16.900243998 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:23.027095079 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:23.075714111 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:27.169816971 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:27.290487051 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:27.567317009 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:27.569031954 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:27.688992977 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:37.951292038 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:38.071913958 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:38.342232943 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:38.344546080 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:38.464370966 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:48.732750893 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:48.853998899 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:49.126388073 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:49.147450924 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:49.267404079 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:53.017194986 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:53.060285091 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.249763012 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.369520903 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.369580030 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.489372969 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.489437103 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.609230042 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.609304905 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.639652967 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.639739037 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.760195017 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.760258913 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.801351070 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.841528893 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:57.921319008 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:57.921391010 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.072211981 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.072299004 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.113143921 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.113229990 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.233089924 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.233396053 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.235488892 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.306176901 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.307543039 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.424527884 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.424647093 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:52:58.427501917 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:52:58.544528961 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:05.420005083 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:05.539882898 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:05.809387922 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:05.811383009 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:05.931067944 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:07.826394081 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:07.946290970 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:07.946387053 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:08.066308022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:08.066375971 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:08.186070919 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:08.693489075 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:08.700680971 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:08.820468903 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:08.885353088 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:08.895596027 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:09.015389919 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:09.015614033 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:09.135427952 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.201308012 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:13.321022034 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.321078062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:13.441095114 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.591028929 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.593306065 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:13.713078022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.782911062 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.789181948 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:13.905453920 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.909209013 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:13.909269094 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:14.029563904 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.326224089 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:18.445904970 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.446188927 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:18.566000938 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.716074944 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.717506886 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:18.838738918 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.948431015 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:18.951579094 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:19.072505951 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:20.357606888 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:20.477365971 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:20.746449947 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:20.748543978 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:20.869071007 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.012393951 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.060487986 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.373251915 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.493096113 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.493168116 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.612987995 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.613045931 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.732786894 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.732856989 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.762556076 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.810417891 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.896569014 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.896625042 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:23.924998045 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:23.966677904 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.019943953 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.019999027 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.045082092 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.091665030 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.180536985 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.180592060 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.212059975 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.263613939 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.300446987 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.309489012 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.331789017 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.389484882 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.403975010 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.409487963 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.472682953 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.473579884 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:24.529289961 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:24.593380928 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:28.361509085 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:28.482848883 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:28.750891924 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:28.753509998 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:28.873384953 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:30.217037916 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:30.336967945 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:30.609206915 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:30.615761042 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:30.735577106 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:31.373420954 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:31.493527889 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:31.763494015 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:31.765569925 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:31.885435104 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:32.498670101 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:32.618849993 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:32.888725042 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:32.894836903 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:33.014679909 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:33.873394012 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:33.993273973 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:33.993354082 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:34.113276958 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.262810946 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.267586946 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:34.389725924 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.454783916 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.456398010 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:34.576096058 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.582798958 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.585552931 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:34.748487949 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:34.748769999 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:34.868587971 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:44.498305082 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:44.618030071 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:44.618110895 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:44.738284111 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:44.842109919 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:44.887408972 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:44.935605049 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:44.961970091 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:44.962121964 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:45.079370022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:45.081828117 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:45.083731890 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:45.203593016 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:45.271123886 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:45.273261070 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:45.393003941 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:48.889646053 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:49.009336948 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:49.279664040 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:49.283011913 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:49.404143095 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:52.998497963 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:53.169991016 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:55.295392990 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:55.415285110 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.415345907 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:55.535000086 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.684382915 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.686368942 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:55.806140900 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.876208067 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.877932072 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:55.997698069 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:55.999633074 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:56.119782925 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:56.389276981 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:56.391216040 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:56.510971069 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:58.451519012 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:58.571240902 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:58.840908051 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:53:58.843235016 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:53:58.965086937 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:00.389143944 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:00.508888960 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:00.779182911 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:00.783683062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:00.903552055 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:04.139233112 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:04.259155035 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:04.529202938 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:04.530905962 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:04.650741100 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.405181885 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.525126934 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.525186062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.646269083 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.646334887 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.766280890 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.766360044 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.794342995 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.841927052 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.928510904 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.928564072 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:05.958461046 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:05.998188019 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.048544884 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.048595905 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.078234911 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.123178959 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.208715916 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.208805084 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.240531921 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.295047045 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.329054117 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.329837084 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.364986897 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.421710014 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.492497921 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.493825912 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.613635063 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:06.733051062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:06.852938890 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:07.122548103 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:07.127399921 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:07.247159958 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:10.529728889 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:10.650499105 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:10.795393944 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:10.915272951 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:10.917804003 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:10.920295954 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:10.969739914 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:11.080571890 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:11.081864119 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:11.184396982 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:11.201711893 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:11.201885939 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:11.321686983 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:11.376410007 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:11.378092051 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:11.497872114 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:12.592238903 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:12.711930037 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:12.990963936 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:13.037972927 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:13.157666922 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:13.623585939 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:13.745001078 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:14.013417006 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:14.015697002 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:14.135354042 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:15.952461004 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.072621107 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.072679996 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.192965031 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.193025112 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.312895060 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.312968016 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.342457056 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.388876915 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.480427980 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.480660915 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.505072117 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.561775923 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.600645065 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.600739002 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.629705906 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.670105934 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.764424086 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.764606953 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.793421030 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.842370987 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.884607077 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.885859013 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.912569046 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.969770908 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:16.984612942 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:16.984781027 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:17.048485994 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:17.049952030 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:17.104506969 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:17.104520082 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:17.157058954 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:17.169749022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:17.173922062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:17.293704033 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:21.732867956 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:21.852718115 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:22.124512911 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:22.126219034 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:22.246030092 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.005897045 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.065821886 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:23.268132925 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:23.387928009 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.436098099 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:23.556423903 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.658723116 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.660873890 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:23.780962944 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.850907087 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:23.854546070 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:23.974464893 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:24.123864889 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:24.244791985 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:24.519618988 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:24.524044991 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:24.643810034 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:27.826881886 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:27.946579933 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:28.221620083 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:28.223861933 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:28.343852043 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:28.348005056 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:28.467776060 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:28.760551929 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:28.767975092 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:28.887649059 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.249053001 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:32.368791103 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.368918896 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:32.488614082 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.649590015 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.651849031 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:32.771682024 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.839443922 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:32.841253042 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:32.961884975 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:35.201894045 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:35.321582079 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:35.594594002 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:35.596235991 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:35.716006994 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:37.623836994 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:37.743657112 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:37.743721962 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:37.863606930 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.022255898 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.023977995 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:38.143754005 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.214607000 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.225270987 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:38.335753918 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.345118999 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:38.345177889 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:38.464967966 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:41.358119965 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:41.477952957 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:41.754667997 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:41.756094933 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:41.875987053 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:47.920660019 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.040429115 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.040496111 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.160413027 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.160484076 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.280314922 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.315320969 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.317787886 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.473149061 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.479376078 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.632143021 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.635266066 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.795118093 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.795299053 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:48.956496000 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:48.956628084 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:49.076459885 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:50.045645952 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:50.331223965 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:50.439572096 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:50.444472075 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:50.564378977 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:53.035657883 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:53.077977896 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:58.532177925 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:58.651962996 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:58.926837921 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:54:58.931930065 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:54:59.051676035 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:03.624219894 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:03.743947983 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:03.744012117 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:03.866168976 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:03.866228104 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:03.985904932 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:03.985964060 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.044955015 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.045047998 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.105729103 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.106569052 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.178003073 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.226362944 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.226422071 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.297954082 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.342297077 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.346311092 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.346389055 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.418605089 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.466440916 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.468116045 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.493041039 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.538419008 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.541531086 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.612761974 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.615242004 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:04.661333084 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:04.735085011 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:08.405251980 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:08.524914026 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:08.818147898 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:08.824172974 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:08.944911003 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:09.764714003 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:09.884449959 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:10.195768118 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:10.216773987 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:10.336602926 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.295975924 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:14.416734934 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.416795015 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:14.536503077 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.536587000 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:14.656655073 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.731719017 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.733614922 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:14.853430033 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.923712969 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:14.926084995 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:15.045782089 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:15.045941114 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:15.048109055 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:15.168195963 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:15.237401009 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:15.238976002 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:15.359040022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:17.453010082 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:17.572762012 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:17.868211985 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:17.870498896 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:17.990936995 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.220324993 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:19.340157032 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.467984915 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:19.587758064 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.587816954 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:19.643256903 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.643332958 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:19.707520008 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.707571030 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:19.763063908 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.827378035 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.891434908 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:19.893542051 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.013245106 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.022990942 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.025182962 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.192595959 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.205473900 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.207587957 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.328960896 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.329018116 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.337860107 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.389348984 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.496467113 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:20.500231028 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:20.620557070 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:23.012613058 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:23.062125921 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:24.749846935 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:24.869632006 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.138915062 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.186168909 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:25.196464062 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:25.316160917 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.318218946 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:25.438035965 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.717521906 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.719587088 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:25.840049028 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.910003901 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:25.912209988 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:26.032572031 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:26.032649040 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:26.152524948 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:27.032730103 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:27.152770996 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:27.423799992 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:27.426139116 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:27.546987057 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:30.389691114 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:30.512561083 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:30.779175043 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:30.781522989 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:30.903558969 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:31.905365944 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:32.029980898 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:32.300740004 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:32.305069923 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:32.424731970 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:33.467768908 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:33.587564945 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:33.856873989 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:33.859411001 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:33.980052948 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:35.484357119 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:35.604063034 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:35.624063015 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:35.744218111 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:35.744277000 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:35.864052057 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:35.873754978 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:35.879077911 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:36.044483900 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:36.056077003 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:36.058058023 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:36.177828074 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:36.191030025 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:36.202774048 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:36.364480019 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:38.327490091 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:38.447192907 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:38.716717005 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:38.719818115 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:38.839631081 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:45.795991898 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:45.915741920 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:45.915813923 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:46.035655022 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:46.184847116 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:46.188046932 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:46.308291912 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:46.376650095 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:46.378739119 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:46.498627901 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.112416983 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:47.232235909 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.456337929 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:47.501331091 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.545712948 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:47.576174021 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.576226950 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:47.696001053 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.846221924 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:47.905010939 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:47.959548950 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:48.079356909 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:49.780401945 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:49.900243998 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:50.170507908 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:50.172405958 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:50.292176962 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:50.749454975 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:50.869319916 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:51.138442039 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:51.142268896 CET	49705	1300	192.168.2.10	87.120.116.179
Dec 6, 2024 10:55:51.262964964 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:53.035494089 CET	1300	49705	87.120.116.179	192.168.2.10
Dec 6, 2024 10:55:53.094278097 CET	49705	1300	192.168.2.10	87.120.116.179

Analysis Process: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exePID: 7572, Parent PID: 3968

General

Target ID:	0
Start time:	04:51:45
Start date:	06/12/2024
Path:	C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Desktop\1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe"
Imagebase:	0x8f0000
File size:	36'864 bytes
MD5 hash:	3B418FCBDD3C8E5B79AE86050618B81D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: MALWARE_Win_AsyncRAT, Description: Detects AsyncRAT, Source: 00000000.00000000.1248923168.00000000008F2000.00000002.00000001.01000000.00000003.sdmp, Author: ditekSHen Rule: JoeSecurity_XWorm, Description: Yara detected XWorm, Source: 00000000.00000002.3686976828.0000000002C91000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Chronological Activities

Disassembly

Reset < >

Analysis Process: 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exePID: 7572, Parent PID: 3968COMMON

Execution Graph

Execution Coverage:	20.9%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FF7C132A6A4 Relevance: 2.2, Strings: 1, Instructions: 973
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

xM_H, xrefs: 00007FF7C132AC6D

Memory Dump Source

Source File: 00000000.00000002.3689334897.00007FF7C1320000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1320000_1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31.jbxd

Similarity

API ID:
String ID: xM_H
API String ID: 0-2997469637
Opcode ID: 99b2b661c7b594268e13130fc95d4806cfc07649901bb0288ec37b69779558f1
Instruction ID: 399d35e91f9ac77168ff869f39221fa6efe251428fedc3df0e6c799f8ac8fb90
Opcode Fuzzy Hash: 99b2b661c7b594268e13130fc95d4806cfc07649901bb0288ec37b69779558f1
Instruction Fuzzy Hash: 8C625530B1C91A4FEB98FB388455679B2D2FF98364B9146B9D50EC3687DE78EC428740

Function 00007FF7C13268F6 Relevance: .5, Instructions: 468
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3689334897.00007FF7C1320000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1320000_1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d85dc499c25a44f26768446955d55d51d4a1849b17d9e78ac233b2f513ab25
Instruction ID: 55d4a58dd89fb4061be70e1952ce921716a78bf47117c41d0013d175f68cb8af
Opcode Fuzzy Hash: a6d85dc499c25a44f26768446955d55d51d4a1849b17d9e78ac233b2f513ab25
Instruction Fuzzy Hash: AEF1A470A08A8D8FEBA8EF28D8557E977D1FF54310F44427EE84DC7296CB74A9418B81

Function 00007FF7C13276A2 Relevance: .5, Instructions: 454
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.3689334897.00007FF7C1320000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1320000_1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 570ce009e074db4b052ef12cb50f3109d33e574d26879636ac106082b75c1f02
Instruction ID: f0741c5c20af9e22fd2f286b2b56297c2bf50640b5210df7f679b3000e647b15
Opcode Fuzzy Hash: 570ce009e074db4b052ef12cb50f3109d33e574d26879636ac106082b75c1f02
Instruction Fuzzy Hash: 89E1A330A08A4D8FEBA8EF28C8597E977D1FF54310F54427ED84DC7296DE78A9418B81

Function 00007FF7C1321BF8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowsHookExW.USER32 ref: 00007FF7C1321CC1

Memory Dump Source

Source File: 00000000.00000002.3689334897.00007FF7C1320000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FF7C1320000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7ff7c1320000_1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31.jbxd

Similarity

API ID: HookWindows
String ID:
API String ID: 2559412058-0
Opcode ID: 414418c9a2c579b4b60a9627876b29a73bffcf920955774daa62a885c1816d09
Instruction ID: a8a6efce894754f718f3e85e8c6592006686e802dc9b027e12fb8427c846f66d
Opcode Fuzzy Hash: 414418c9a2c579b4b60a9627876b29a73bffcf920955774daa62a885c1816d09
Instruction Fuzzy Hash: D841F630A0CA5D4FDB18EF6C98466F9BBE1EF5A321F00427ED049D3292CA75A852C7C1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Xworm

Yara Signatures

Initial Sample

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

Statistics

CPU Usage

Windows Analysis Report
1733477410ba2e5b8e1739578ed6933c4e69d66a81049f523c11599f36b2f5da870a31538a881.dat-decoded.exe

Function 00007FF7C132A6A4 Relevance: 2.2, Strings: 1, Instructions: 973
COMMON

Function 00007FF7C13268F6 Relevance: .5, Instructions: 468
COMMON

Function 00007FF7C13276A2 Relevance: .5, Instructions: 454
COMMON

Function 00007FF7C1321BF8 Relevance: 1.6, APIs: 1, Instructions: 139
COMMON